Ethical Hacking News
A devastating supply chain attack has been revealed, leaving numerous organizations around the world vulnerable to a sophisticated backdoor attack. The attack, which has been attributed to attackers tampering with AOMEI Backupper's update servers, has been described as opportunistic and has affected systems in 11 countries. The attack highlights the vulnerability of software supply chains and the importance of monitoring and testing for security vulnerabilities. Organizations are urged to take immediate action to protect themselves against similar attacks in the future.
A devastating supply chain attack has been revealed, affecting systems in 11 countries. Attackers tampered with AOMEI Backupper's update servers to install a backdoor. The attack was opportunistic and involved changing two text files on the server for a few minutes. AOMEI Backupper initially attributed the attack to intercepted and changed files in transit. The attack had a significant impact on affected systems, with some machines running a genuine copy of Radmin. The attack highlights the vulnerability of software supply chains and the importance of monitoring and testing for security vulnerabilities. AIME Backupper has since reported fixing its servers, but the fix does not remove the backdoor from affected machines. The attack raises questions about vendor-side security measures and the need for more robust testing and validation procedures. Organizations should take immediate action to protect themselves against similar attacks in the future. Block attacker infrastructure, update security protocols, and thoroughly test software supply chains.
A devastating supply chain attack has been revealed, leaving numerous organizations around the world vulnerable to a sophisticated backdoor attack. The attack, which has been attributed to attackers tampering with AOMEI Backupper's update servers, has been described as opportunistic and has affected systems in 11 countries, including Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States.
According to the Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab, the attack involved attackers repeatedly changing the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time. This allowed any copy of the Windows backup program that checked for an update during one of those windows to download and run a backdoor. The attackers only had to change two text files on the server for a few minutes, and the elevation of the backdoor depended on how the AOMEI service was running.
The attack was first discovered by ManageEngine's lab, which recorded AOMEI Backupper installing Radmin on two unrelated customers in different countries on May 28. The lab notified AOMEI on June 7, and the vendor initially explained that the content had been intercepted and changed in transit. However, the lab later found evidence that supported the fact that the change was being served from AOMEI's own servers.
The attack had a significant impact on the systems affected, with some machines running a genuine, signed copy of Radmin, a commercial remote-administration tool, while others were infected with a separate implant that gave a remote shell and could fetch and run new code on command. The implant communicated with a single hard-coded address with no backup, making it difficult to block the attacker's control.
The attack highlights the vulnerability of software supply chains and the importance of monitoring and testing for security vulnerabilities. AOMEI Backupper has since reported fixing its servers, but the fix does not remove the backdoor from machines that were already hit. GTIG and Mandiant urge organizations running AOMEI software to hunt across the whole April-to-July period to detect and remove any potential backdoors.
The attack has also raised questions about the effectiveness of vendor-side security measures and the need for more robust testing and validation procedures. AOMEI Backupper's vulnerability to tampering has been attributed to the lack of cryptographically verified file signatures and the use of unsigned files to verify updates.
In light of this attack, it is essential for organizations to take immediate action to protect themselves against similar attacks in the future. This includes preserving files cached in the program's own folders, checking network logs for what was served at the exact time the alert fired, and hunting for scheduled tasks, unsigned upgrade-now.exe files, and attacker files staged under the local Radmin application-data folder.
Furthermore, organizations should block the attacker infrastructure named in both reports, including the storage-data.com, promotion.storage-data.com, and aomei.storage-data.com domains, and block outbound SMB (TCP 445) and WebDAV to external addresses to stop the credential trick. They should also update their security protocols and testing procedures to ensure that software supply chains are thoroughly tested and validated.
In conclusion, the AOMEI Backupper supply chain attack highlights the importance of robust testing, validation, and monitoring procedures to ensure the security of software supply chains. It also emphasizes the need for organizations to stay vigilant and proactive in protecting themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Devastating-Supply-Chain-Attack-AOMEI-Backuppers-Vulnerability-to-Tampering-ehn.shtml
https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
Published: Fri Oct 16 14:50:05 2026 by llama3.2 3B Q4_K_M
