AOMEI Update Servers Compromised to Distribute Malware

Recent Supply Chain Attack on AOMEI

Hackers have effectively compromised AOMEI's update servers, manipulating the system to distribute malware through a built-in promotional feature within its backup software, AOMEI Backupper. This sophisticated supply chain attack lasted from April to July 2026, during which adversaries tampered with configuration files before reverting them to disguise the breach. Researchers from ManageEngine's Threat Analysis Lab (METAL), collaborating with Google's Threat Intelligence Group (GTIG) and Mandiant, spearheaded the investigation into this complex attack.

Detection of the Malware Campaign

The first evidence of this attack came on May 28, when ManageEngine's endpoint security software detected AOMEI Backupper unexpectedly installing the legitimate remote administration tool Radmin across computers at two different companies located in separate countries. This triggered suspicions as AOMEI's promotional processes, which typically handle updates and notifications, were responsible for the installation.

Despite initial tests on their own systems yielding no viruses, researchers noted that AOMEI Backupper had been accessing its servers and downloading what appeared to be legitimate configuration files. These investigations revealed that the hackers had only temporarily altered a couple of configuration files before returning them to their original state, making the malicious activities difficult to trace.

How the Attackers Manipulated Configuration Files

Malicious Redirects

The hackers targeted two specific configuration files: down_html.ini and Notifycfg.ini. The first file dictates where AOMEI Backupper should acquire update packages, while the second governs user notifications and can trigger executable content on users' computers. By modifying these files, the attackers were able to redirect the software to download a malicious ZIP archive. Subsequently, the notification system executed the malware due to its integration with the application, avoiding any need for user interaction.

Execution of Malware

Initial tests confirmed by Google verified this malicious execution process. On July 16, continuous monitoring of AOMEI's infrastructure by ManageEngine finally identified the compromised files in action. This revelation led to the discovery that the attackers had manipulated the expected checksums in the configuration, thereby bypassing the software's internal file verification processes. During the incident, the researchers pinpointed three separate windows when AOMEI's servers distributed the malicious content:

• May 28: 10-minute exposure (05:40 – 05:50 UTC)
• July 16: 6-minute exposure (08:33 – 08:39 UTC)
• July 20: 5-minute exposure (10:35 – 10:40 UTC)

Malware Types and Impact

During the brief exposure periods, the attackers managed to install two malware variants, CROSSROAD and SHINYROAD, on affected systems. The CROSSROAD downloader performed reconnaissance on the infected machine and subsequently retrieved additional components, ensuring persistence via a scheduled task. The SHINYROAD malware, acting as a backdoor, employed legitimate components from Radmin to load malicious code and initiate communication with an attacker-controlled command-and-control server, enhancing their control over the system.

In a specific attack observed on July 20, an additional method was utilized by the hackers. They exploited the software's notification system in an attempt to steal Windows authentication hashes by directing it to connect to a server controlled by the attackers, leveraging an invisible popup. This potentially exposed NTLM hashes that could be easily cracked with various tools at the attackers' disposal.

Global Impact of the Attack

The attacks impacted organizations across various sectors, including IT services, telecommunications, and higher education, in multiple countries such as the United States, Australia, India, Singapore, Spain, and Switzerland. Google's report highlighted that the attacks were opportunistic in nature, indicating that many more organizations could have been affected if they happened to check for software updates during the specified exposure windows.

Response from AOMEI and Ongoing Investigation

Once alerted on June 7, AOMEI's initial response suggested the possibility that the content might have been intercepted during transmission. However, ManageEngine's analysis promptly raised questions about this explanation, given that the intercepted content indeed originated from AOMEI's own servers and not from external sources.

Following further investigations, ManageEngine captured additional attacks on July 16, presenting AOMEI with original and altered file hashes and details regarding the compromised files. AOMEI's response involved conducting their internal audit, which reportedly found no breach evidence initially but later confirmed the possibility of unauthorized adjustments to their servers.

As of late July, AOMEI had begun several changes, including transferring the impacted configuration files to a more secure infrastructure with enhanced logging capabilities and requested assistance from incident-response specialists, connecting with Mandiant in the process.

What’s Next for AOMEI Key Points to Follow

Currently, AOMEI states that its CTO is personally heading the investigation into the situation, which has been classified as high priority. They have discussed measures taken to secure the servers and mentioned upgrading their infrastructure in the wake of the background of the attack.

However, ManageEngine has specified that while these changes prevent new infections, they cannot remedy existing malware already present on customer systems. As a result, organizations using AOMEI Backupper are recommended to review indicators of compromise, focusing on:

• Unusual scheduled tasks
• Unexpected executable files in AOMEI installation directories
• Connections to attacker-controlled infrastructure

Malicious Configuration Exposure Windows

Key Takeaways

• The supply chain attack on AOMEI servers took place from April to July 2026.
• Malicious configuration files were exposed for a total of 21 minutes across three separate incidents.
• AOMEI Backupper installed malware on computers worldwide, affecting multiple sectors.
• CROSSROAD and SHINYROAD malware variants were utilized in the attack.
• Existing malware remains on infected systems despite AOMEI’s updates and server security improvements.

Conclusion

This case of supply chain compromise underscores the ongoing vulnerabilities in software systems, particularly how attackers can exploit update mechanisms. The AOMEI incident highlights the necessity for organizations to enhance their monitoring protocols and remain vigilant against potential breaches that target software delivery paths. As AOMEI continues to monitor and address the aftermath of the attack, affected organizations must act quickly to assess their security posture and take necessary precautionary measures.