The 10-Minute Window That Let Hackers Slip a Backdoor Into Your Backup Software

Michael Miller · 2026-10-16

Picture this: you open your backup software, click "check for updates," and everything looks normal. The download finishes in seconds. Nothing feels off. But for a brief stretch between May and July 2026, that exact click could have handed a backdoor straight to attackers. That's the unsettling reality researchers uncovered with AOMEI Backupper, a popular Windows backup tool. Attackers didn't break into the software itself. They went after something sneakier — the update servers that feed it new files. ### How the Attack Actually Worked The mechanics here are worth understanding, because they're a playbook more attackers will likely copy. According to findings from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team, the attackers repeatedly swapped out the files that AOMEI Backupper pulls from the vendor's own update servers. But they didn't leave the malicious files sitting there for weeks. Instead, they worked in tiny windows — just five to ten minutes at a time — spread across several months. If your copy of the program happened to check for an update during one of those windows, it would download and run the backdoor without any warning. Think of it like a thief who only picks the lock while the security guard is on a coffee break. Most of the time, the door is fine. But catch it at the wrong moment, and you're compromised. ### Why Short Windows Are So Dangerous This approach is clever for a few reasons: - **It's hard to catch.** A tampered file that lives for ten minutes barely registers on routine monitoring scans. - **It targets trust.** You expect updates from your software vendor to be safe. That assumption is exactly what got exploited. - **It scales quietly.** Anyone who updated during those windows got hit, and they'd have no idea. > "The scariest part of a supply chain attack isn't the malware itself — it's that you invited it in yourself, believing it was legitimate." ### What This Means for You If you run AOMEI Backupper, especially in a business setting, this is a good moment to slow down and check a few things: - Review your update logs to see whether any installs happened during the affected period. - Run a full scan with reputable security tools on any machine that updated recently. - Consider whether your update process has any verification step beyond "the vendor says it's fine." ### The Bigger Lesson About Trust We tend to think of software updates as the safe part of computing. They're supposed to fix problems, not create them. But this incident shows that the update channel itself is a target — and a tempting one, because it bypasses so many defenses. For anyone managing multiple machines or accounts, the takeaway is simple: verify what you can, question what you can't, and don't assume "automatic" means "safe." A few minutes of caution beats months of cleanup. The researchers who spotted this deserve credit for catching something that was designed to be nearly invisible. But the rest of us should treat it as a reminder — the quiet moments are often when the most damage gets done.