← All stories

Threat intel

Attackers Tampered with AOMEI Backupper Update Servers in Brief Windows to Deliver a Backdoor

By The Hacker News1 min read

Attackers repeatedly swapped files on AOMEI Backupper's own update servers in five-to-ten-minute windows between May and July 2026, so any copy of the Windows backup program that checked for updates during those windows would download and run a backdoor, The Hacker News reported. The activity was documented by Google Threat Intelligence Group, Mandiant, and ManageEngine researchers.

Cover for a threat-intel story

**Supply-Chain Attack Hits AOMEI Backupper Users**

Attackers repeatedly tampered with the update files served by AOMEI Backupper's own update servers, using brief windows of five to ten minutes at a time between May and July 2026, The Hacker News reported. Any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor instead of a legitimate update.

The activity was documented by Google Threat Intelligence Group, Mandiant, and ManageEngine's threat analysis researchers, according to the report.

The technique is a form of supply-chain compromise that abuses the trust users and software place in official update channels. By keeping the malicious files in place for only a few minutes at a time, the attackers narrowed the pool of potential victims to systems that happened to check for updates during those windows. The approach can also make an operation harder to detect and investigate after the fact, since the servers would appear to be serving legitimate files the vast majority of the time.

Key details from the report:

  • **Target:** AOMEI Backupper, a backup program for Windows
  • **Method:** Files fetched from the vendor's update servers were swapped in short, repeated windows
  • **Timeframe:** May through July 2026
  • **Payload:** A backdoor installed through the software's own update process
  • **Reported by:** Google Threat Intelligence Group, Mandiant, and ManageEngine

The available excerpt of The Hacker News report did not specify how many users were affected or who was behind the campaign.

Source: The Hacker News

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.