{ "intelligence": { "actors": [], "attack_details": { "coverage": "source-limited", "registry_sha256": "7223cc7111f6b7ecd6c2c688bf98f0c497fd742891a42f68a9a7b9601492b78d", "schema_version": 1, "source_paragraphs": 25, "sources": [ { "document_sha256": "b09ddbdbf1f1f5763a1f59487e293ab7213b2c8000a9fb0e18a7747941fea91e", "name": "Malwarebytes", "retrieved_at": "2026-10-19T22:02:39.932748+00:00", "role": "primary", "source_id": "primary", "url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc" } ], "steps": [ { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Les attaquants ont compromis l’infrastructure de mise à jour et de notification d’AOMEI Technology entre avril et juillet." } ] }, "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 1, "direct_entities": 8, "direct_relationships": 10, "invalid_iocs": 0, "iocs": 1, "mentioned": 2, "mitre_associated": 1, "mitre_direct": 1, "targets": 0, "techniques": 1, "unsupported_indicators": 4, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 18, "excluded_graph_objects": 60, "graph_complete": true, "graph_objects": 8, "graph_relationships": 10, "mitre_context_complete": true, "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "status_as_of": "2026-10-19T22:02:04+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.768Z", "created_at": "2026-10-19T15:45:11.330Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-19T15:45:11.640Z", "updated_at": "2026-10-19T15:45:11.640Z" }, "description_available": false, "entity_type": "Malware", "id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "is_inferred": false, "labels": [], "lang": "en", "name": "upgrade-now.exe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "malware--7b7c63ba-4a09-5d26-a4de-4556a9be7428", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.792Z", "created_at": "2026-10-19T15:45:17.843Z", "modified": "2026-10-19T15:45:24.660Z", "updated_at": "2026-10-19T15:45:24.660Z" }, "description_available": false, "entity_type": "Indicator", "id": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "indicator--05ebfc5d-42e6-5529-b611-08e1458abe01", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-19T15:45:16.352Z", "updated_at": "2026-10-19T15:45:17.116Z" }, "description_available": false, "entity_type": "Hostname", "id": "48614516-6c97-4296-9d80-d4b7ee32c4e8", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "hostname--53276f2c-81c6-5ea8-9eea-a210a43b07fd", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-06-17T22:18:01.220Z", "updated_at": "2026-10-19T15:45:17.504Z" }, "description_available": false, "entity_type": "Hostname", "id": "488b6611-286f-485b-8cf6-0892ad3b5055", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "hostname--9dec2ef2-8e9e-525a-919a-9bb1e642b0e1", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.789Z", "created_at": "2026-10-19T15:45:17.844Z", "modified": "2026-10-19T15:45:23.504Z", "updated_at": "2026-10-19T15:45:23.504Z" }, "description_available": false, "entity_type": "Indicator", "id": "aab666f3-24f5-4737-89cc-31431f13a281", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "indicator--d80bfeb4-69b7-553c-b2ae-fcf15716d8a1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.787Z", "created_at": "2026-10-19T15:45:17.709Z", "modified": "2026-10-19T15:45:20.741Z", "updated_at": "2026-10-19T15:45:20.741Z" }, "description_available": false, "entity_type": "Indicator", "id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "indicator--7dccfd12-76a4-59d9-a697-a0d8f86268f6", "type": "Indicator" }, { "__typename": "AttackPattern", "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "entity_type": "Attack-Pattern", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "labels": [], "lang": "en", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "attack-pattern--be8b782f-8ecd-5dd6-817b-9a97173465ca", "type": "AttackPattern" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-06-17T22:18:00.948Z", "updated_at": "2026-10-19T15:45:17.337Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "f06818cd-bdd9-46cc-ab28-98f8a05252a1", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "domain-name--483b8acb-3bc6-5365-9175-b79e35ae4cba", "type": "DomainName" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.785Z", "created_at": "2026-10-19T15:45:34.763Z", "modified": "2026-10-19T15:45:34.965Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:34.965Z" }, "description_available": false, "entity_type": "uses", "fromId": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "from_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "from_name": "upgrade-now.exe", "from_type": "Malware", "id": "218b0905-95a2-4ea0-802c-0b465d1a2499", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--19e74b50-b709-505b-930e-6842c8b46e3f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.813Z", "created_at": "2026-10-19T15:45:55.683Z", "modified": "2026-10-19T15:45:55.951Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:55.951Z" }, "description_available": false, "entity_type": "indicates", "fromId": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_id": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_name": null, "from_type": "Indicator", "id": "3c1ae3b5-07fa-40b2-878a-769e1aa3f50f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--80d78779-11e6-50c8-9c90-c5c9c989fc94", "toId": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_name": "upgrade-now.exe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.791Z", "created_at": "2026-10-19T15:45:34.408Z", "modified": "2026-10-19T15:45:34.761Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:34.761Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aab666f3-24f5-4737-89cc-31431f13a281", "from_id": "aab666f3-24f5-4737-89cc-31431f13a281", "from_name": null, "from_type": "Indicator", "id": "3d8be385-efbc-4fa2-a947-640a085c2528", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--e46c99cb-d65b-5cf3-b611-94e0342fbd98", "toId": "488b6611-286f-485b-8cf6-0892ad3b5055", "to_id": "488b6611-286f-485b-8cf6-0892ad3b5055", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.803Z", "created_at": "2026-10-19T15:45:44.763Z", "modified": "2026-10-19T15:45:45.135Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:45.135Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aab666f3-24f5-4737-89cc-31431f13a281", "from_id": "aab666f3-24f5-4737-89cc-31431f13a281", "from_name": null, "from_type": "Indicator", "id": "4ef3d10d-af70-49ed-a154-561a8913d7a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--72dd7406-7d34-5fd8-9e37-d19261a6fc1c", "toId": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_name": "upgrade-now.exe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.801Z", "created_at": "2026-10-19T15:45:43.724Z", "modified": "2026-10-19T15:45:43.982Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:43.982Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_name": null, "from_type": "Indicator", "id": "500dbe0b-df25-43fe-9936-92ff2a7e268c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--2ade86c6-b605-5abc-9458-30d12a256056", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.812Z", "created_at": "2026-10-19T15:45:52.955Z", "modified": "2026-10-19T15:45:54.856Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:54.856Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aab666f3-24f5-4737-89cc-31431f13a281", "from_id": "aab666f3-24f5-4737-89cc-31431f13a281", "from_name": null, "from_type": "Indicator", "id": "54ba2689-5984-4cc9-be3a-9f57d8b045b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--4a9e3baa-ced9-51d6-8355-a9843301da7f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.793Z", "created_at": "2026-10-19T15:45:35.038Z", "modified": "2026-10-19T15:45:35.384Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:35.384Z" }, "description_available": false, "entity_type": "based-on", "fromId": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_id": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_name": null, "from_type": "Indicator", "id": "b1573350-b537-4eb5-8ff9-8721ec7fd38d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--976ec898-e371-59dd-a48a-340c952d52f7", "toId": "48614516-6c97-4296-9d80-d4b7ee32c4e8", "to_id": "48614516-6c97-4296-9d80-d4b7ee32c4e8", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.794Z", "created_at": "2026-10-19T15:45:35.232Z", "modified": "2026-10-19T15:45:35.614Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:35.614Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_name": null, "from_type": "Indicator", "id": "ba23bd71-a55f-44a1-90b1-5e6803db5df4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--71acdcaa-ed6f-595c-af1a-3ea6fb99e40f", "toId": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "to_name": "upgrade-now.exe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.788Z", "created_at": "2026-10-19T15:45:32.797Z", "modified": "2026-10-19T15:45:33.793Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:33.793Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "from_name": null, "from_type": "Indicator", "id": "d95d355a-edc5-4aba-abb3-99e74465586e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--e572fad4-4f27-5bbb-841f-4b1ba1cbd2c8", "toId": "f06818cd-bdd9-46cc-ab28-98f8a05252a1", "to_id": "f06818cd-bdd9-46cc-ab28-98f8a05252a1", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.822Z", "created_at": "2026-10-19T15:46:05.330Z", "modified": "2026-10-19T15:46:05.758Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:46:05.758Z" }, "description_available": false, "entity_type": "indicates", "fromId": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_id": "23c70245-e2a3-46d8-9c93-9f35acf3a9a6", "from_name": null, "from_type": "Indicator", "id": "e1b743d6-e911-4372-901b-3ee288b30ca3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--19795352-8e06-50f6-9363-1feb47ad6499", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "storage-data[.]com", "description_available": false, "object_id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "object_ids": [ "c5abb7f1-15fd-4593-b552-6a5381e20032", "f06818cd-bdd9-46cc-ab28-98f8a05252a1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c5abb7f1-15fd-4593-b552-6a5381e20032", "valid_from": "2026-10-19T15:07:21.000Z", "valid_until": "2027-01-30T06:02:29.260Z", "validity_status": "active", "value": "storage-data.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "f06818cd-bdd9-46cc-ab28-98f8a05252a1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "storage-data.com" } ], "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "type": "domain", "valid_from": "2026-10-19T15:07:21.000Z", "valid_until": "2027-01-30T06:02:29.260Z", "validity_status": "active", "value": "storage-data.com" } ], "mentioned": [ { "confidence": 50, "evidence_id": "ea4de683-0cad-4497-a044-65b61045d534", "name": "T1574.002", "role": "mentionné", "type": "Attack-Pattern" }, { "confidence": 50, "evidence_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "name": "upgrade-now.exe", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:39:38.785Z", "created_at": "2026-10-19T15:45:34.763Z", "modified": "2026-10-19T15:45:34.965Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-19T15:45:34.965Z" }, "description_available": false, "entity_type": "uses", "fromId": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "from_id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "from_name": "upgrade-now.exe", "from_type": "Malware", "id": "218b0905-95a2-4ea0-802c-0b465d1a2499", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "standard_id": "relationship--19e74b50-b709-505b-930e-6842c8b46e3f", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "name": "upgrade-now.exe", "type": "Malware" } ] } ], "via_entity": { "id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "name": "upgrade-now.exe", "type": "Malware" } } ], "direct_techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499", "500dbe0b-df25-43fe-9936-92ff2a7e268c", "54ba2689-5984-4cc9-be3a-9f57d8b045b2", "e1b743d6-e911-4372-901b-3ee288b30ca3", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499", "500dbe0b-df25-43fe-9936-92ff2a7e268c", "54ba2689-5984-4cc9-be3a-9f57d8b045b2", "e1b743d6-e911-4372-901b-3ee288b30ca3" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "name": "upgrade-now.exe", "type": "Malware" } ] } ], "official_catalog": { "complete": true, "fetched_at": "2026-10-19T22:02:05Z", "schema_version": 1, "source_sha256": "b7fbfbb4d519fd3751d9d9031cea79a47314c24e5abcb3dfed39c964e12b6150", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-19T15:07:20.711Z", "created_at": "2026-10-19T15:46:09.276Z", "modified": "2026-10-19T15:46:09.573Z", "published": "2026-10-19T15:07:20.711Z", "updated_at": "2026-10-19T15:46:09.573Z" }, "description_available": true, "id": "33428684-00e2-4600-96a7-b41f7b1be00e", "is_inferred": false, "labels": [ "aomei backupper", "remote access backdoor", "software distribution hijacking", "supply chain attack", "update infrastructure compromise", "upgrade-now.exe" ], "lang": "en", "name": "AOMEI Backupper update servers hijacked to push malware: Check your PC", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-10-19T15:07:20.711Z", "references": [ { "external_id": null, "id": "a701486e-6d4a-4942-8729-b99bf91b2b32", "source_name": "alien-vault", "url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc" }, { "external_id": "6ad632287e9fae87583d6526", "id": "d467bb8a-e8b2-4e05-8112-661b80121c50", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ad632287e9fae87583d6526" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc" }, "targets": [], "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499", "500dbe0b-df25-43fe-9936-92ff2a7e268c", "54ba2689-5984-4cc9-be3a-9f57d8b045b2", "e1b743d6-e911-4372-901b-3ee288b30ca3", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "218b0905-95a2-4ea0-802c-0b465d1a2499", "500dbe0b-df25-43fe-9936-92ff2a7e268c", "54ba2689-5984-4cc9-be3a-9f57d8b045b2", "e1b743d6-e911-4372-901b-3ee288b30ca3" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "14c47d0e-c4a8-4f0c-ba51-78f23b868b9c", "name": "upgrade-now.exe", "type": "Malware" } ] } ], "vulnerabilities": [] }, "report_id": "33428684-00e2-4600-96a7-b41f7b1be00e", "schema_version": 1, "selected_date": "2026-10-19", "source_url": "https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc" }