AOMEI update service quietly delivered backdoors to customers
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 20th, 2026.
Attackers compromised AOMEI’s update and notification infrastructure and used the trusted delivery path to install malware through its backup software. They briefly altered configuration files, changed the expected checksum, and triggered execution without requiring the user to act. Researchers confirmed three short delivery windows between May and July. The resulting malware established persistence and remote command access, while one observed attempt tried to capture Windows authentication hashes.
For leaders, this matters because a legitimate backup application became the attack route, reaching organizations in several countries and sectors. For defenders, a server-side correction can prevent new infections, but it doesn’t remove malware already installed on customer computers. The short tampering windows also made the attack difficult to reproduce and easy to miss. Investigators should review unexpected Radmin installations, suspicious scheduled tasks, unfamiliar files in AOMEI directories, and outbound connections associated with the campaign.
Hunt every system that used AOMEI Backupper during the reported period, and isolate any host that shows the published compromise indicators.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
