AOMEI update servers quietly delivered backdoors to customers
Daily Cyber News: AOMEI update servers quietly delivered backdoors to customers
AOMEI’s server-side delivery path was manipulated in short windows to install malware through its backup software. Between April and July, attackers changed configuration files for five to ten minutes at a time and then restored them, making the activity difficult to catch. Systems checking in during confirmed windows could receive Radmin and the SHINYROAD backdoor.
Key context: The attack abused a trusted vendor channel instead of asking users to install an obviously unrelated file.
Additional detail: Use the published indicators to hunt AOMEI systems, investigate confirmed matches deeply and reset credentials where forced authentication or malware delivery may have occurred.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.
Topics: cybersecurity news, cybersecurity, cyber risk, malware, windows, AOMEI, servers, quietly, delivered, backdoors.
