{"id":245639,"date":"2026-10-19T22:42:37","date_gmt":"2026-10-20T03:42:37","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/hackers-hijack-aomei-update-servers-to-secretly-spread-malware"},"modified":"2026-10-19T22:42:37","modified_gmt":"2026-10-20T03:42:37","slug":"hackers-hijack-aomei-update-servers-to-secretly-spread-malware","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/hackers-hijack-aomei-update-servers-to-secretly-spread-malware","title":{"rendered":"Hackers hijack AOMEI update servers to secretly spread malware"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-hijack-aomei-update-servers-to-secretly-spread-malware.jpg\"><\/a><\/p>\n<p>Hackers reportedly compromised AOMEI\u2019s servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.<\/p>\n<p>The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems.<\/p>\n<p>Researchers at ManageEngine\u2019s Threat Analysis Lab (METAL), working with Google\u2019s Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers reportedly compromised AOMEI\u2019s servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks. The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,34],"tags":[],"class_list":["post-245639","post","type-post","status-publish","format-standard","hentry","category-biotech-medical","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245639"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245639\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}