Attackers tampered with AOMEI Backupper update servers to deliver backdoor

Between May and July 2026, attackers repeatedly altered files served by AOMEI Backupper's own update servers in windows of five to ten minutes. Any copy of the Windows backup tool that checked for updates during those windows downloaded and ran a backdoor. Google Threat Intelligence Group, Mandiant and ManageEngine uncovered the campaign.

• AOMEI Backupper update servers were tampered with from May to July 2026
• Attack windows lasted only five to ten minutes each
• Affected users downloaded and ran a backdoor during update checks
• Google Threat Intelligence Group, Mandiant and ManageEngine uncovered the attack