AOMEI Backupper's Update Servers Were Hijacked for Minutes—Here's What That Means for You

Michael Miller · 2026-10-16

Imagine this: you open your backup software, click "check for updates," and within minutes, your system is quietly infected with a backdoor. That's exactly what happened to AOMEI Backupper users between May and July 2026. Attackers tampered with the vendor's own update servers, repeatedly swapping out update files for just five to ten minutes at a time. Any Windows machine that checked for updates during those brief windows downloaded and ran a backdoor. Security researchers from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team uncovered the scheme. It's a chilling reminder that even trusted update mechanisms can become attack vectors. ### How the Attack Worked The attackers didn't breach AOMEI's servers once and stay put. Instead, they played a high-stakes game of whack-a-mole. They'd modify the update files, wait for a few unlucky users to download the malicious payload, then restore the original files—all within minutes. This made detection incredibly difficult. Most users would never notice anything amiss, and the vendor's own monitoring might not catch such fleeting changes. - **Short windows:** The malicious files were live for only 5–10 minutes at a time. - **Repeated strikes:** The attackers did this multiple times over three months. - **Silent delivery:** The backdoor installed itself without any obvious signs. ### Why This Matters to You If you use AOMEI Backupper—or any software that auto-updates—this should raise a red flag. Update servers are a juicy target because they're trusted by default. When you hit "update," you're essentially giving the vendor permission to run code on your machine. If that server is compromised, you're compromised. "The scariest part is how little time it takes," says one security researcher familiar with the investigation. "You don't need a sophisticated exploit—just a few minutes of access and a user who happens to check for updates at the wrong time." ### What You Can Do First, don't panic. But do take action: - **Check for updates manually** from the official website rather than relying on in-app updaters. - **Use a reputable security suite** that can detect backdoors and suspicious behavior. - **Monitor your network** for unusual outbound connections—backdoors often phone home. - **Consider isolating backup software** on a separate machine or virtual environment. ### The Bigger Picture This isn't just about AOMEI. It's a wake-up call for the entire software supply chain. Attackers are increasingly targeting update mechanisms because they offer a direct path into thousands of systems. Whether you're an IT pro or a home user, staying vigilant about updates—and the channels they come through—is more important than ever. As for AOMEI, the company has likely patched the vulnerability, but the incident underscores the need for constant vigilance. Your best defense? Assume nothing is safe by default, and verify everything.