AOMEI, a Hong Kong-registered company that makes Windows backup software, has not yet identified or notified customers infected by malware following a supply-chain attack. Hackers compromised AOMEI’s update servers between April and July, temporarily redirecting users to download malicious files. Cybersecurity researchers from ManageEngine and Google detected the breach and warned AOMEI in June, though the company initially attributed the issue to attackers intercepting updates rather than problems with its own infrastructure. AOMEI only identified evidence of the intrusion after ManageEngine provided specific timing details in July.
Google researchers identified victims across telecommunications, IT services, and higher education in countries including the United States, Australia, India, and Brazil. However, the actual number of infected machines is likely much higher given the brief windows during which malware was distributed. The attackers exploited an unauthenticated channel used for promotional pop-ups rather than exploiting the backup tool itself. Experts warn that fixing AOMEI’s servers will not clean already-infected computers, and organizations are urged to search for signs of compromise throughout the April-July period. The attackers’ origin and motivation remain unknown.
Source: Read the full story at The Record
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
