Hackers Hijacked AOMEI Backupper's Update Servers for Just Minutes

Michael Miller · 2026-10-16

Picture this: you open your backup software, click "check for updates," and go grab a coffee. You trust that process completely. Now imagine that during those few minutes, someone swapped the update file for a backdoor. That's exactly what happened to AOMEI Backupper users this year. ### The Attack Window Was Shockingly Small Between May and July 2026, attackers repeatedly altered the files that AOMEI Backupper pulls from the vendor's own update servers. The tampering happened in windows of just five to ten minutes at a time. Short, surgical, and timed to catch anyone unlucky enough to check for updates right then. If your copy of the Windows backup program happened to ping the server during one of those windows, it would download and run a backdoor instead of a legitimate update. No phishing email. No sketchy download site. Just the official update channel doing exactly what it was supposed to do — except the payload was poisoned. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team all flagged the activity, which tells you this wasn't some hobbyist poking around. ### Why Supply Chain Attacks Like This Should Worry You This is the part that gets under my skin. We spend so much energy teaching people to avoid bad links and fake downloads. Then the bad guys walk in through the front door — the vendor's own update mechanism. Here's the uncomfortable truth: - Your antivirus may not blink, because the update comes from a trusted domain - Firewalls often allow update traffic by default - The software is legitimate — only the file it fetched wasn't - Five-minute windows mean the malicious version may never be caught in testing > "The most dangerous malware is the kind you install yourself, with full confidence, because someone you trust told you it was safe." That's the whole game with supply chain compromises. Trust is the exploit. ### What This Means If You Run Backup Software Backups are the one tool you absolutely cannot afford to have compromised. They hold your most sensitive data, and they often run with elevated privileges. A backdoor riding in on a backup update is a nightmare scenario — it gets access to everything you were trying to protect. So what do you actually do about it? - **Don't auto-update blindly.** Manual updates during business hours let you verify versions and watch for odd behavior. - **Check vendor advisories.** If a company discloses tampering, confirm which builds are affected before your next update. - **Isolate backup systems.** Your backup machine shouldn't share a network with your daily-driver workstation. - **Verify file hashes** when the vendor publishes them. It's a small step that catches a lot. - **Watch for odd outbound traffic** after any update. A backdoor has to phone home eventually. ### The Bigger Lesson Attackers don't need months of access anymore. A few minutes of server tampering can be enough to seed malware across thousands of machines. The AOMEI Backupper incident is a reminder that the update button is a trust button — and trust needs verification, not blind faith. Keep your software current, sure. But keep your eyes open while you do it.