Attackers Tampered with AOMEI Backupper Update Servers to Deliver Backdoor

According to a report published by The Hacker News on October 16, 2026, attackers gained brief access to AOMEI Backupper's update servers and repeatedly altered the update files served to clients. The tampering occurred in short windows of five to ten minutes, spanning the period between May and July 2026. During these intervals, any copy of AOMEI Backupper that contacted the update server would download a malicious backdoor instead of legitimate update files.

The report notes that the incident was identified and attributed by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team. The threat actors exploited the legitimate update mechanism, meaning that systems checking for updates during the tampered windows would execute code without raising immediate suspicion due to the trusted nature of the update process. The exact number of affected systems and the identity of the threat actors behind the tampering remain unspecified in the source material. AOMEI has not publicly released detailed technical specifics, but the recommended mitigation involves ensuring the software is updated to the latest version and monitoring official advisories for further information.