AOMEI Backupper Update Servers Compromised to Deploy Backdoor
Attackers tampered with AOMEI Backupper's official update servers to deliver malware. Organizations using the backup tool should verify system integrity immediately.
TL;DR
- Threat actors compromised AOMEI Backupper’s update infrastructure between May-July 2026
- During brief windows, updates delivered a backdoor instead of legitimate software patches
- Any user who updated during those periods likely executed malicious code
- Mandiant and Google Threat Intelligence confirmed the supply chain attack
- Organizations must audit systems running AOMEI Backupper for signs of compromise
In a sophisticated supply chain attack, cybercriminals temporarily hijacked the update mechanism of AOMEI Backupper, a widely used Windows backup utility. For several minutes at a time over multiple months, fetching updates from the vendor's official servers resulted in the deployment of a backdoor rather than legitimate software.
The breach occurred between May and July 2026, affecting any organization that performed an update during the short-lived tampering windows. Security researchers from Mandiant and Google Threat Intelligence identified and analyzed the campaign, underscoring the persistent risks posed by compromised software distribution channels.
Supply Chain Compromise Details
- Attackers modified update files on AOMEI's own servers without gaining persistent access
- Each tampering window lasted only 5–10 minutes, reducing detection chances
- The backdoor was served selectively during specific update checks
- No evidence suggests the core AOMEI infrastructure was permanently breached
- Attack likely leveraged stolen credentials or temporary server-side access
Impact and Defensive Actions
- Organizations using AOMEI Backupper should treat affected systems as potentially compromised
- IT teams must review logs for suspicious activity around update timestamps
- Endpoint detection and response tools can help identify backdoor behavior
- Software vendors are urged to implement stronger update signing and verification
- Multi-factor authentication and least privilege policies reduce risk of similar breaches
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.