AOMEI Backupper Update Servers Hit by Brief, Repeated Backdoor Attacks

Emily Davis · 2026-10-16

Imagine this: you fire up your backup software to grab the latest update, and for just a few minutes, the update server is serving up malware instead of a patch. That's exactly what happened with AOMEI Backupper between May and July 2026. Attackers repeatedly tampered with the files on the vendor's own update servers, each time for windows of only five to ten minutes. If your copy of the Windows backup program checked for an update during one of those windows, it would download and run a backdoor. Scary stuff, right? Security researchers from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team uncovered the campaign. They found that the attackers were able to modify the update mechanism itself, not just the files. This means even legitimate-looking update checks could have been hijacked. ### How the Attack Worked The attackers didn't need a massive window of opportunity. They only needed a few minutes each time. Here's the rough sequence: - The attackers gained access to the update servers or the update delivery process. - For short bursts, they replaced the legitimate update files with a malicious version containing a backdoor. - Any AOMEI Backupper installation that checked for updates during that window downloaded and executed the backdoor. - After the window closed, the servers returned to normal, making detection harder. This "low and slow" approach is becoming more common because it's stealthy. Traditional security tools might not flag a brief anomaly, especially if the update server is trusted. ### What This Means for You If you use AOMEI Backupper, you might be wondering if you're affected. The researchers haven't disclosed specific victim counts, but the implications are clear: even trusted update channels can be compromised. That's a wake-up call for anyone who relies on automatic updates. > "The supply chain is only as strong as its weakest link, and update servers are often that link." – Anonymous security researcher So what can you do? First, check if you've installed any updates for AOMEI Backupper between May and July 2026. If so, run a full system scan with a reputable antivirus tool. Second, consider disabling automatic updates for critical software and instead download updates manually from the vendor's official website after verifying the checksum. Third, keep an eye on vendor advisories—AOMEI may release a security patch or guidance soon. ### The Bigger Picture This isn't just about one backup tool. It's a reminder that supply chain attacks are evolving. Attackers are targeting the trust we place in software updates. Whether you're an IT pro or a home user, staying informed and cautious is your best defense. And if you're in the market for privacy tools, remember that antidetect browsers can help protect your online identity, but they're not a substitute for good security hygiene. Stay safe out there, and don't ignore those update prompts—just make sure they're coming from a trusted source.