AOMEI Backupper Update Servers Compromised to Distribute Backdoor via Malicious Updates

Attackers manipulated AOMEI Backupper's update servers for short intervals between May and July 2026, injecting malicious code that delivered a backdoor to affected users. The incident was identified through collaboration between Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis.

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.

Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis

Read original article