What happened
Attackers reportedly compromised infrastructure used by AOMEI and abused a built-in promotional/update mechanism in its backup software to distribute malicious software. The most operationally important detail is the reported tradecraft: configuration files were briefly tampered with and then restored to their original state. That is classic low-and-slow supply-chain behavior designed to defeat casual integrity checks, make the delivery window hard to reconstruct, and leave endpoint telemetry looking normal after the payload has already run.
No CVE identifier is provided in the source summary, and defenders should not invent one. Treat this as an active supply-chain/update-channel abuse incident until AOMEI publishes a definitive advisory with affected builds, hashes, domains, and remediation guidance.
Why this matters to defenders
Backup and disk-management tools are high-value targets because they are widely installed with elevated privileges, often run services at startup, and are trusted by users and security tools. If an update or promotional feature can fetch remote content and influence program behavior, compromise of that channel becomes a trusted software-distribution path. The brief restoration of configuration files also means point-in-time checks can miss the event; you need historical telemetry, not just current file state.
Immediate risk: endpoints with AOMEI products installed may have received malicious configuration, promotional content, or secondary payloads during the tampering window. Because the source summary does not list exact indicators, do not wait for perfect IoCs. Hunt for behavior: AOMEI processes making unexpected network requests, spawning script interpreters or LOLBins, writing outside normal program paths, or triggering installs shortly after update/promo activity.
Technical analysis
Affected products and platforms: the source identifies AOMEI backup software and a built-in promotional feature. Exact product names, versions, build numbers, malicious domains, file hashes, and payload names are not included in the provided summary. Confirm scope only from AOMEI's official advisory or your own telemetry; do not rely on screenshots or third-party reposts alone.
CVE and CVSS: none are stated in the news summary. Do not map this to a historical CVE unless AOMEI or a credible advisory explicitly does so. The present-day issue is infrastructure compromise and abuse of a legitimate delivery feature, not a memory-corruption bug with a patch-level diff.
Attack chain from a defender's perspective:
- Adversary gains control of server-side update/promo infrastructure or the content it serves.
- AOMEI endpoint component periodically contacts the service for configuration, promotional content, update metadata, or campaign rules.
- During a short window, tampered configuration tells the client to retrieve, display, launch, or stage attacker-controlled content.
- Payload execution may occur through the trusted AOMEI process, a spawned child process, a browser/promo pane, a script interpreter, or a LOLBin.
- Server-side configuration is restored, reducing obvious evidence and breaking naive diff-based detection.
Exploitation status: the source describes confirmed malicious distribution through hijacked servers. It does not state inclusion in CISA KEV, public PoC, or a specific malware family. Assume active abuse until vendor guidance proves otherwise, but keep detections behavior-based because exact IoCs are not yet in the provided material.
Detection and response
The highest-value endpoint hypothesis is simple: an AOMEI binary or update/promo component should not suddenly launch command shells, script engines, downloaders, or unsigned executables from temporary/user-writable paths. In environments without AOMEI, these rules should be silent. In environments with AOMEI, baseline first and alert on rare child processes plus new network destinations.
---
title: AOMEI Process Spawning Script Interpreter or LOLBin
id: 2f7d9c10-8b3a-4f6e-9d21-7c5a1b8e6042
status: experimental
description: Detects AOMEI backup/update/promo components spawning command shells, script engines, or download-capable LOLBins after possible update-channel abuse.
references:
- https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.t1195.002
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: 'AOMEI'
selection_child:
Image|contains:
- 'powershell.exe'
- 'pwsh.exe'
- 'cmd.exe'
- 'wscript.exe'
- 'cscript.exe'
- 'mshta.exe'
- 'rundll32.exe'
- 'regsvr32.exe'
- 'bitsadmin.exe'
- 'certutil.exe'
- 'curl.exe'
- 'wget.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare vendor diagnostics or support tooling; verify digital signature, command line, and timing against AOMEI update windows
level: high
---
title: AOMEI Component Network Connection Followed by Process Creation
id: 91b6e2a4-0c57-4d38-a6f9-2d81f7c30b55
status: experimental
description: Flags process creation by an AOMEI component where the same process or its parent recently made outbound network activity, consistent with update/promo content triggering execution.
references:
- https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
- https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1071.001
- attack.initial_access
- attack.t1195.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: 'AOMEI'
CommandLine|contains:
- 'http://'
- 'https://'
- 'AppData'
- 'ProgramData'
- 'Temp'
- 'promo'
- 'update'
falsepositives:
- Legitimate AOMEI update checking; require corroboration from network logs, EDR timeline, or vendor advisory before treating as benign
level: medium
---
title: Configuration Tampering Under AOMEI ProgramData or Install Paths
id: 64c1aa7d-5bd2-44f9-9d3a-8e0f2b6c17a9
status: experimental
description: Detects unexpected modification of AOMEI configuration, campaign, or update metadata files by processes that are not AOMEI or a known management agent.
references:
- https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
- https://attack.mitre.org/techniques/T1565/001/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.defense_evasion
- attack.t1565.001
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- 'AOMEI'
selection_ext:
TargetFilename|endswith:
- '.json'
- '.xml'
- '.ini'
- '.config'
- '.cfg'
- '.yaml'
- '.yml'
filter_known:
Image|contains:
- 'AOMEI'
- 'SCCM'
- 'Intune'
- 'ManageEngine'
- 'Tanium'
condition: selection_path and selection_ext and not filter_known
falsepositives:
- Enterprise software deployment, backup job changes, or manual admin edits; scope to file names tied to update/promo config once AOMEI publishes exact paths
level: medium
// Sentinel/Defender hunt: AOMEI process network activity plus suspicious child execution
let Lookback = 14d;
let Lolbins = dynamic(['powershell.exe','pwsh.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','bitsadmin.exe','certutil.exe','curl.exe','wget.exe']);
let AomeiProc =
DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where InitiatingProcessFolderPath has 'AOMEI' or FolderPath has 'AOMEI' or InitiatingProcessFileName has 'AOMEI'
| project DeviceId, DeviceName, AomeiTime=Timestamp, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256, ReportId;
let AomeiNet =
DeviceNetworkEvents
| where Timestamp >= ago(Lookback)
| where InitiatingProcessFolderPath has 'AOMEI' or InitiatingProcessFileName has 'AOMEI'
| project DeviceId, NetTime=Timestamp, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine;
AomeiProc
| where FileName in~ (Lolbins) or ProcessCommandLine has_any ('http://','https://','AppData','ProgramData','Temp','promo','update')
| join kind=leftouter AomeiNet on DeviceId
| extend TimeDeltaToNetwork = datetime_diff('second', AomeiTime, NetTime)
| where isnull(TimeDeltaToNetwork) or abs(TimeDeltaToNetwork) <= 900
| summarize FirstSeen=min(AomeiTime), LastSeen=max(AomeiTime), Commands=make_set(ProcessCommandLine, 20), RemoteUrls=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, FileName, SHA256
| order by LastSeen desc
-- Velociraptor hunt: enumerate AOMEI processes, suspicious command lines, and current outbound connections
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)AOMEI' OR CommandLine =~ '(?i)AOMEI'
SELECT Pid, Name, RemoteAddr, RemotePort, State, CommandLine
FROM netstat()
WHERE CommandLine =~ '(?i)(AOMEI|powershell|cmd|rundll32|mshta|bitsadmin|certutil)'
OR Name =~ '(?i)AOMEI'
# AOMEI update/promo abuse - verify, contain, and collect evidence
# Run elevated on endpoints or via your RMM. Replace domain/path placeholders only with vendor-confirmed IoCs.
$EvidenceRoot = Join-Path $env:ProgramData 'SecurityArsenal-AOMEI-IR'
New-Item -ItemType Directory -Path $EvidenceRoot -Force | Out-Null
# Inventory possible AOMEI binaries and services
$InstallRoots = @($env:ProgramFiles, ${env:ProgramFiles(x86)}, $env:ProgramData) | Where-Object { $_ -and (Test-Path $_) }
$AomeiFiles = foreach ($root in $InstallRoots) { Get-ChildItem -Path $root -Recurse -ErrorAction SilentlyContinue -Filter '*AOMEI*' | Select-Object FullName, Length, LastWriteTime }
$AomeiFiles | Export-Csv (Join-Path $EvidenceRoot 'aomei_files.csv') -NoTypeInformation
Get-Service | Where-Object { $_.Name -match 'AOMEI' -or $_.DisplayName -match 'AOMEI' } | Export-Csv (Join-Path $EvidenceRoot 'aomei_services.csv') -NoTypeInformation
# Capture recent process, network, and config-change evidence available locally
Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -match 'AOMEI' -or $_.CommandLine -match 'AOMEI|powershell|cmd|rundll32|mshta|bitsadmin|certutil' } | Select-Object ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine, CreationDate | Export-Csv (Join-Path $EvidenceRoot 'process_snapshot.csv') -NoTypeInformation
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess, CreationTime | Export-Csv (Join-Path $EvidenceRoot 'network_snapshot.csv') -NoTypeInformation
# Check recent writes under likely AOMEI config locations without assuming exact vendor paths
foreach ($root in $InstallRoots) { Get-ChildItem -Path $root -Recurse -ErrorAction SilentlyContinue -Include '*.json','*.xml','*.ini','*.config','*.cfg','*.yaml','*.yml' | Where-Object { $_.FullName -match 'AOMEI' -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Select-Object FullName, LastWriteTime, Length } | Export-Csv (Join-Path $EvidenceRoot 'recent_config_writes.csv') -NoTypeInformation
# Temporary containment: block outbound traffic for unsigned or unknown AOMEI binaries until vendor guidance is validated
foreach ($file in $AomeiFiles) {
if ($file.FullName -match '\.exe$') {
$sig = Get-AuthenticodeSignature -FilePath $file.FullName -ErrorAction SilentlyContinue
if (-not $sig -or $sig.Status -ne 'Valid') {
New-NetFirewallRule -DisplayName ('IR-Block-AOMEI-Unsigned-' + (Split-Path $file.FullName -Leaf)) -Direction Outbound -Program $file.FullName -Action Block -ErrorAction SilentlyContinue | Out-Null
}
}
}
# Pull installed version evidence for vendor advisory comparison
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'AOMEI' } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation | Export-Csv (Join-Path $EvidenceRoot 'installed_versions.csv') -NoTypeInformation
Write-Output ('Evidence collected at ' + $EvidenceRoot + '. Compare installed versions and network destinations to AOMEI official advisory before unblocking.')
Remediation
- Freeze trust in the channel: until AOMEI confirms clean infrastructure and affected builds, temporarily disable automatic update/promo features where policy allows, and block outbound access from AOMEI binaries to unapproved destinations. Do not rely on the endpoint UI alone if your management plane can enforce firewall or EDR network control.
- Establish scope: inventory every endpoint with AOMEI backup, partition, or related utilities. Record DisplayVersion, install path, service names, file signatures, and last update check time. The exact clean build number must come from AOMEI's official advisory; the provided summary does not include it, so do not guess.
- Preserve history: collect EDR process timelines, DNS/proxy logs, firewall egress, Sysmon process creation/network connection events, and file-modification telemetry for at least the suspected window plus dwell time on either side. Because configs were reportedly restored, current file content is insufficient.
- Verify before updating: download updates only from AOMEI's official site or a vendor-linked advisory, validate digital signatures, compare published hashes when available, and stage updates in a controlled ring before broad deployment. Official starting points: https://www.aomeitech.com/ and the source report at https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/.
- Look for secondary payloads: hunt for persistence, new services, Run keys, scheduled tasks, browser extensions, and credential access that began shortly after AOMEI update/promo network activity. Treat any unsigned child process from an AOMEI path as incident-worthy.
- If compromise is confirmed: isolate affected hosts, revoke exposed credentials used on those hosts, reimage or restore from known-good media where execution is confirmed, and require vendor-attested clean installers before redeployment. Report through your IR retainer and, where applicable, regulatory clock starts only after scoping, not before evidence preservation.
There is no CISA KEV deadline stated in the provided item. If AOMEI or CISA later publishes a KEV entry, affected builds, or a federal remediation deadline, pivot immediately to that authoritative guidance and update your compensating controls.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.