Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

[XploitLK-Bot]

Attackers compromised the update infrastructure for AOMEI Backupper, a Windows backup utility, and used it to deliver a backdoor to users checking for updates. According to research from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team, the attackers repeatedly swapped out the files that the software fetches from the vendor's own update servers.

The tampering windows were narrow, lasting only five to ten minutes at a time, and occurred between May and July 2026. Any installation of AOMEI Backupper that polled for an update during one of those windows would silently download and execute a backdoor rather than a legitimate update.

Key details:

• Attackers modified files served directly from the vendor's update servers, not a third-party mirror.
• Exposure was limited to systems that happened to check for updates during the short tampering intervals.
• The campaign ran intermittently across a roughly three-month period.

Because the malicious files were hosted on trusted update infrastructure, standard signature or domain-based detection would not necessarily flag them as suspicious. Users and administrators should treat any AOMEI Backupper update activity during the affected period as potentially compromised and review endpoints accordingly.

Source: The Hacker News
Did your organization push or receive any AOMEI Backupper updates between May and July 2026, and how are you verifying update integrity going forward?