AOMEI Backupper's Update Infrastructure Briefly Hijacked to Push a Backdoor

What happened

According to The Hacker News, citing research from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team, attackers repeatedly tampered with the files served by AOMEI Backupper's own update servers between May and July 2026. The tampering occurred in short windows — roughly five to ten minutes at a time — during which any installation of the Windows backup software that happened to check for updates would fetch and execute a backdoor instead of a legitimate update.

Why it matters

This is a supply-chain compromise at the distribution layer rather than a code-signing or build-pipeline breach: the vendor's update mechanism itself was weaponized for brief, deliberately narrow windows, likely to limit exposure and detection. Any organization running AOMEI Backupper that had the update-check feature enabled during one of these windows could have received and executed attacker-controlled code with the trust level of the legitimate vendor update process. Because backup software typically runs with elevated privileges and broad filesystem access, a backdoor delivered this way could represent a significant foothold.

What defenders should do

• Inventory whether AOMEI Backupper is deployed in your environment and check version/update-check logs for activity during May–July 2026.
• Review endpoint and network telemetry for AOMEI Backupper processes spawning unexpected child processes, making unusual outbound connections, or writing unfamiliar binaries shortly after an update check.
• Hunt for anomalous files or persistence mechanisms associated with the AOMEI update directory or installation path.
• Treat auto-update mechanisms for third-party software — especially backup and other privileged utilities — as a monitored attack surface, not just a patch-delivery channel.
• Watch for vendor advisories or indicator releases from AOMEI, Google Threat Intelligence Group, Mandiant, or ManageEngine for specific IOCs tied to this campaign.

Developing story

Details on attribution, the specific backdoor delivered, and full scope of impact were not fully specified in initial reporting. This is net-new intelligence and the picture may evolve as the named research teams publish further findings. See the original report: The Hacker News.