Hackers hijack AOMEI update servers to secretly spread malware
Summary
Hackers successfully compromised AOMEI's update servers to distribute malware using a built-in promotional feature in their backup software. The attackers tampered with configuration files but restored them to their original state to conceal their actions.
IFF Assessment
This incident represents a malicious attack where legitimate software distribution channels were compromised to spread malware, posing a direct threat to users and defenders.
Defender Context
This incident highlights the risk of supply chain attacks, where attackers compromise trusted software vendors to distribute their malicious payloads. Defenders should be vigilant about software updates and implement robust endpoint detection and response (EDR) solutions to identify and block any unexpected or malicious software installations.