AOMEI Server Hacked: Malware Spread via Backup Software

Hackers compromised AOMEI's update servers to spread malware through an integrated advertising feature in the backup software. The attackers temporarily manipulated configuration files before reverting them to their original state to obscure the attacks. The vulnerability was discovered when users of AOMEI's backup software noticed unexpected activities in their systems. Reports indicate that the servers were attacked through a vulnerability in the software that allowed the attackers to distribute malicious updates. The exact method by which the hackers gained access to the servers is currently unclear.

IT security experts warn of the potential consequences of this attack. The malware could be used to steal personal data or infiltrate systems. AOMEI has not yet issued an official statement regarding the incidents, which heightens concerns about the security of their software. The attackers exploited a feature that allows advertisements to be displayed within the software. This feature was used as a gateway to spread the malware.

Users who updated the software may have unknowingly downloaded the harmful files. The security community has already begun analyzing the spread of the malware. Initial reports suggest that the malware is capable of self-replication and spreading across networks. This could lead to widespread infection if not acted upon quickly. AOMEI software is used by many businesses and private users worldwide, increasing the potential reach of the malware.

Experts recommend temporarily refraining from using the software until AOMEI provides an official confirmation regarding the resolution of the security vulnerability. Users should also check their systems for signs of infection. The incidents raise questions about the overall security of backup software. Many users rely on such programs to protect their data, and an attack on the update servers could significantly undermine trust in these solutions. The vulnerability could also impact other software products that use similar update mechanisms.

The exact number of affected users is currently unknown. However, security researchers estimate that several thousand systems could potentially be at risk. Investigations into the identity of the attackers and the exact functioning of the malware are ongoing. The incidents have already led to increased attention to cybersecurity measures. Companies are urged to review their security protocols and ensure that their systems are equipped to defend against similar attacks.

The vulnerability could also lead to a reassessment of security standards in software development. AOMEI software has received positive reviews in the past for its user-friendliness and functionality. However, the current incidents could damage the company's image. Experts advise considering alternative backup solutions until AOMEI resolves the security issues. The vulnerability and the associated attacks are another example of the growing threats in the field of cybersecurity. According to the Cybersecurity & Infrastructure Security Agency (CISA), there was a 30% increase in cyberattacks on businesses worldwide in 2025.