Hackers compromise AOMEI update servers to distribute malware

Hackers compromised servers belonging to software vendor AOMEI to distribute malware through a built-in promotional feature, BleepingComputer reported. BleepingComputer, TechInformed, and BankInfoSecurity all report that attackers altered update files to deliver malicious payloads. [1][2][3]

According to BleepingComputer, the supply chain attacks occurred between April and July 2026. The incident targeted the update and notification systems of AOMEI Backupper, a Windows tool used for backing up data, cloning disks, and restoring systems. Attackers briefly tampered with configuration files and then restored them to their original state to evade detection. [1]

The activity was discovered by researchers at ManageEngine Threat Analysis Lab working alongside Google Threat Intelligence Group, BleepingComputer reported. [1]

Supply chain compromises present significant risks to enterprise networks because update mechanisms run with elevated privileges. As FTMQ Security reported earlier, attackers frequently target management tools and infrastructure to establish footholds for lateral movement inside organizations. [1][6]