The 10-Minute Window That Let Hackers Slip a Backdoor Into Your Backup Software

Michael Miller · 2026-10-16

Imagine this: you fire up your backup software, click "check for updates," and for a few minutes, the update server you trust is serving malware. That's not a hypothetical. It's exactly what happened with AOMEI Backupper between May and July 2026. Attackers didn't break into AOMEI's servers and stay there. Instead, they repeatedly swapped out the update files for just five to ten minutes at a time. If your copy of Backupper happened to ping the server during one of those short windows, it would download and run a backdoor. The rest of the time, everything looked normal. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team all confirmed the campaign. And it's a reminder that even your backup tool—the thing you trust to keep your data safe—can become an attack vector. ### Why short windows are so dangerous Most of us assume that if a website or update server is compromised, it stays compromised until someone notices. But these attackers used a hit-and-run approach. They'd modify the update payload, wait for a few victims to download it, then restore the original files. By the time anyone thought to check, the evidence was gone. That makes detection incredibly hard. Traditional security scans might never see the malicious file because it's only live for minutes. And if you're one of the unlucky ones who updated during that window, your system is already infected. ### What this means for your backup strategy Backups are supposed to be your safety net. But if the backup software itself is compromised, you're in trouble. Here's what you can do: - **Delay updates by a few days.** Unless there's a critical security patch, wait a week before installing updates. Many attacks rely on fast distribution. - **Verify update signatures.** Check that your software uses code signing and that the signature is valid before running any update. - **Use isolated environments.** If possible, test updates on a separate machine before rolling them out to your main system. - **Keep offline backups.** An offline copy can't be infected by a malicious update. Rotate drives regularly. > "The scariest part isn't that they got in. It's that they were in and out before anyone could blink." — Michael Miller, Lead Antidetect Browser Strategist & Architect ### The bigger picture: supply chain trust This isn't just about AOMEI. It's about the trust we place in every auto-update mechanism. From browsers to backup tools, we've built a system where software constantly reaches out to servers we don't control. When those servers are compromised—even briefly—the consequences can be severe. So next time you see that update notification, take a breath. Maybe wait a day. Your data is worth the extra caution. And if you're managing multiple systems, consider using tools that let you control when and how updates are applied. Because in the world of cybersecurity, a few minutes can make all the difference.