Hackers Turned a Backup Tool Into a Malware Spreader

Hackers hijacked a popular backup tool's update servers to secretly distribute malware, then quickly covered their tracks to avoid detection.

Hackers executed a sophisticated supply chain attack by compromising servers belonging to AOMEI, a popular provider of backup and disk management software. According to reporting from BleepingComputer, the attackers targeted the infrastructure responsible for delivering in-app promotional content. For a brief period, they altered server-side configuration files to push malware to users of AOMEI Backupper instead of the intended advertisements. The attack was notably stealthy; after distributing the malicious payload, the threat actors quickly restored the original configuration files. This hit-and-run tactic was designed to erase their tracks and make the compromise extremely difficult to detect through forensic analysis of the server, leaving compromised user systems as the primary evidence of the breach. The incident serves as a critical reminder that the trust placed in a software vendor extends to their entire delivery infrastructure, which can become an attack vector.

This attack's mechanism highlights a subtle but significant vulnerability in modern software distribution. Rather than exploiting a flaw in the AOMEI application's code itself, the attackers targeted the dynamic content delivery system. Many applications use such features to display messages, offers, or updates by fetching content from a remote server. By hijacking this communication channel, the attackers turned a benign feature into a malware dropper. The malicious payload was delivered to an application that was legitimately installed, properly signed, and trusted by the operating system and security tools. This bypasses many traditional security controls that focus on preventing unauthorized software installation. The attackers' decision to revert the server configuration immediately after the attack suggests a highly targeted operation, aimed at infecting a specific set of users or operating within a narrow time window to minimize the chances of discovery.

The AOMEI supply chain attack fits into a dangerous and growing trend of targeting software vendors to reach their customers. It echoes the strategies seen in other high-profile incidents like the SolarWinds and Kaseya breaches, but with a key difference in the point of compromise. While SolarWinds involved infiltrating the build process and Kaseya exploited a product vulnerability, this attack focused on the content delivery infrastructure—often a softer and less-monitored target. This approach demonstrates that an organization's security perimeter must include not just its code repositories and build servers, but also the web servers, content delivery networks, and APIs that support its products in the field. Every element in the chain, from development to in-app updates, represents a potential point of failure that attackers can exploit to turn trusted software into a weapon.

For IT and security teams, this incident underscores the limitations of a security model based solely on trusting software signatures and vendors. The primary takeaway is the critical importance of defense-in-depth, particularly robust network monitoring and egress filtering. Even when a trusted application is compromised, its malicious activity can often be detected by spotting unusual outbound network connections as the malware attempts to communicate with a command-and-control server. This reinforces the principles of a zero-trust architecture, where no application or internal traffic is implicitly trusted. Organizations must assume that any software could be compromised and implement controls to verify its behavior. Looking ahead, security teams should prepare for more attacks on these peripheral software infrastructure components, as they provide a high-leverage entry point for sophisticated threat actors.

This incident is a classic supply chain attack, demonstrating how even legitimate, signed software can be weaponized. For security and IT teams, it highlights the critical need to monitor network traffic for anomalies, as trusting software vendors alone is insufficient.

A compromised software update mechanism erodes customer trust and can lead to widespread breaches across a company's user base. This attack vector turns a trusted vendor into a significant security liability, posing a direct threat to any organization relying on their software.