AOMEI Backupper Supply Chain Attack: Update Server Tampering Delivered Backdoors — Detection and Remediation Guide

---
title: AOMEI Backupper Updater Spawning Shell or Script Interpreter
id: 3f8a2c71-9d4e-4b6a-a1f2-7c5d8e9b0a34
status: experimental
description: Detects the AOMEI Backupper update process spawning command shells, script interpreters, or LOLBins. Consistent with the 2026 supply-chain campaign in which tampered update payloads executed a backdoor via the trusted updater.
references:
  - https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Backupper.exe'
      - '\ABUpdate.exe'
      - '\ABUpdateService.exe'
      - '\ABNotify.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\schtasks.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate update workflows invoking msiexec for package installation — validate against file hashes and timestamps within the May-July 2026 window
level: high
---
title: Executable Launched From AOMEI Temporary or Update Staging Directories
id: 8b1d4e62-2a7f-4c39-b5e1-9d3f6a8c2e17
status: experimental
description: Detects execution of binaries from AOMEI Backupper update staging, temp, or user-writable directories. Tampered supply-chain payloads are typically staged in product-controlled or temporary paths before execution.
references:
  - https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\AOMEI Backupper\Update\'
      - '\AOMEI Backupper\Temp\'
      - '\AOMEI\Temp\'
      - '\AppData\Local\Temp\AB'
      - '\AppData\Roaming\AOMEI\'
  filter_legit:
    Image|endswith:
      - '\ABUpdate.exe'
      - '\Backupper.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate hotfix stubs during genuine updates — correlate with the campaign timeframe and verify signatures
level: high
---
title: Persistence Established by AOMEI Updater Child Process
id: c4e7a1f3-6b2d-4e58-9c31-2f8b7d4a5e96
status: experimental
description: Detects scheduled task creation, service installation, or Run key registration where the responsible process traces to the AOMEI Backupper updater tree — a hallmark of a backdoor achieving persistence post-install.
references:
  - https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
  - https://attack.mitre.org/techniques/T1053/005/
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1543.003
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    CommandLine|contains|all:
      - 'schtasks'
      - '/create'
  selection_sc:
    CommandLine|contains|all:
      - 'sc.exe'
      - 'create'
  selection_reg:
    CommandLine|contains|all:
      - 'reg.exe'
      - ' add '
    CommandLine|contains:
      - '\CurrentVersion\Run'
      - 'Winlogon'
      - 'Image File Execution Options'
  selection_parent:
    ParentCommandLine|contains:
      - 'AOMEI'
      - 'Backupper'
      - 'ABUpdate'
  condition: 1 of selection_* and selection_parent
falsepositives:
  - AOMEI's own backup scheduling tasks created through the product UI (these originate from Backupper.exe interactively, not from an update chain) — verify task names against the product's known 'AOMEI*' task naming
level: critical

// Hunt: AOMEI Backupper updater spawning suspicious child processes or persistence mechanisms
// Campaign window: May-July 2026, but backdoors persist — run across full retention
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","schtasks.exe","sc.exe","wmic.exe","bitsadmin.exe","certutil.exe","reg.exe","msiexec.exe","net.exe","net1.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("Backupper.exe","ABUpdate.exe","ABUpdateService.exe","ABNotify.exe")
   or InitiatingProcessCommandLine has_any ("AOMEI","ABUpdate")
| where FileName in~ (suspiciousChildren)
| project Timestamp, DeviceName, AccountName,
          UpdaterProcess = InitiatingProcessFileName,
          UpdaterCmd = InitiatingProcessCommandLine,
          ChildProcess = FileName,
          ChildCmd = ProcessCommandLine,
          SHA256, FolderPath, ReportId
| order by Timestamp asc;
// Companion hunt: network connections originating from AOMEI processes to non-AOMEI infrastructure
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("Backupper.exe","ABUpdate.exe","ABUpdateService.exe","ABNotify.exe")
| where RemoteUrl !has_any ("aomei.com","aomeitech.com") and RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
            RemoteEndpoints = make_set(RemoteUrl, 20), IPs = make_set(RemoteIP, 20)
          by DeviceName, InitiatingProcessFileName
| order by FirstSeen asc;

-- Hunt: AOMEI Backupper supply-chain backdoor artifacts
-- Surfaces processes running from AOMEI staging/temp paths and unsigned binaries in AOMEI install dirs
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       authenticode(filename=Exe) AS Signature
FROM pslist()
WHERE Exe =~ '(?i)AOMEI|ABUpdate|Backupper'
   OR CommandLine =~ '(?i)AOMEI Backupper.*(Temp|Update|Stage)'
   OR Exe =~ '(?i)AppData.*(Temp|Roaming).*AOMEI'

-- Companion: enumerate unsigned executables planted in AOMEI install directories
SELECT FullPath, Size, Mtime, Ctime,
       authenticode(filename=FullPath) AS Authenticode
FROM glob(globs=[
  'C:/Program Files*/AOMEI*/**/*.exe',
  'C:/Program Files*/AOMEI*/**/*.dll',
  'C:/ProgramData/AOMEI*/**/*.exe',
  'C:/Users/*/AppData/Roaming/AOMEI*/**/*.exe'
])
WHERE Authenticode.Description =~ 'Unsigned'
   OR Mtime > '2026-05-01' AND Mtime < '2026-08-01'

# AOMEI Backupper supply-chain compromise verification script
# Run elevated on all endpoints with AOMEI Backupper installed
# Output: JSON report per host for IR triage

$report = [ordered]@{ Hostname = $env:COMPUTERNAME; Timestamp = (Get-Date).ToString('o') }

# 1. Inventory AOMEI installation and version
$aomei = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
         "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
         Where-Object { $_.DisplayName -match 'AOMEI Backupper' }
$report.InstalledVersion = $aomei.DisplayVersion
$report.InstallLocation  = $aomei.InstallLocation

# 2. Flag unsigned or campaign-window-modified binaries in AOMEI directories
$paths = @("$env:ProgramFiles\AOMEI*", "${env:ProgramFiles(x86)}\AOMEI*", "$env:ProgramData\AOMEI*")
$suspiciousFiles = foreach ($p in $paths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.Status -ne 'Valid' -or ($_.LastWriteTime -gt '2026-05-01' -and $_.LastWriteTime -lt '2026-08-01')) {
            [pscustomobject]@{ Path=$_.FullName; SigStatus=$sig.Status; Signer=$sig.SignerCertificate.Subject; Modified=$_.LastWriteTime }
        }
    }
}
$report.SuspiciousBinaries = $suspiciousFiles

# 3. Audit scheduled tasks, services, and Run keys referencing AOMEI paths
$report.SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -notmatch '^AOMEI' -and ($_.Actions.Execute -match 'AOMEI|ABUpdate') } |
    Select-Object TaskName, @{n='Action';e={$_.Actions.Execute}}, @{n='Args';e={$_.Actions.Arguments}}
$report.SuspiciousServices = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'AOMEI' -and $_.Name -notmatch '^(ABService|Backupper)' } |
    Select-Object Name, PathName, StartMode, State
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
$report.SuspiciousRunKeys = foreach ($k in $runKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties |
    Where-Object { $_.Value -match 'AOMEI' } | Select-Object Name, Value
}

# 4. Enumerate live network connections from AOMEI processes
$report.AomeiConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -match 'AOMEI' } |
    Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess

$report | ConvertTo-Json -Depth 5 | Out-File "C:\IR\AOMEI-Triage-$env:COMPUTERNAME.json" -Force
Write-Host "Triage report written to C:\IR\AOMEI-Triage-$env:COMPUTERNAME.json"

# 5. If compromise indicators found: isolate host, kill AOMEI processes, block update channel pending clean reinstall
# Stop-Process -Name 'Backupper','ABUpdate*','ABNotify' -Force -ErrorAction SilentlyContinue
# New-NetFirewallRule -DisplayName 'IR-Block-AOMEI-Update' -Direction Outbound -Program 'C:\Program Files*\AOMEI*\*.exe' -Action Block