Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers compromised AOMEI Backupper's update servers, modifying files for short periods of time to deliver a backdoor to users who updated the program during those windows. The tampering occurred between May and July 2026, with changes made in intervals of five to ten minutes. This allowed the attackers to distribute the backdoor to any copy of the Windows backup program that checked for updates during one of these brief periods. The incident was analyzed by the Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis. The attackers' ability to modify the update servers, even if only temporarily, put users at risk of downloading and running malicious code. The backdoor was delivered to vulnerable systems through the compromised update mechanism.