AOMEI update servers hijacked to distribute malware via backup software

Tue, 20 Oct 2026 15:39:31 +0000

Engineer — Plan: If AOMEI backup products are in your environment, audit endpoints that ran the software during the compromise window for malware indicators and verify current update server integrity; no KEV or PoC signals yet to escalate to Act.
SOC/IR — Act: Sweep endpoints running AOMEI backup software for unexpected processes or outbound connections spawned during the compromise window; hunt for lateral movement from hosts where the promotional feature may have delivered a payload.
Leader — Learn: A reminder that backup and recovery tooling is an attractive supply-chain vector; no broad systemic impact confirmed yet, but file for vendor risk review discussions around update-mechanism security in critical software.

Software-Update on CuraSec