AOMEI Backupper's Update Servers Were Hijacked for Just Minutes

Emily Davis · 2026-10-16

Imagine downloading an update for your backup software, the one tool you trust to keep your files safe, and instead pulling down a backdoor. That's exactly what happened to AOMEI Backupper users this spring and summer. Between May and July 2026, attackers didn't break into the software itself. They went after something sneakier: the update servers that the program talks to when it checks for a new version. For windows of just five to ten minutes at a time, they swapped out the files being served. Any copy of the Windows backup tool that happened to check for an update during one of those tiny windows would quietly download and run malicious code. ### Why a Ten-Minute Window Is Enough You might think a few minutes is nothing. But think about how many machines ping an update server every single day. Thousands of computers, all checking in on their own schedules, means even a short window catches real victims. The attackers didn't need all day. They just needed the right sliver of time, repeated over and over. That pattern is what makes this case stand out. It wasn't a single smash-and-grab. It was a patient, repeating ambush, timed to slip past anyone glancing at the server. ### Who Caught It The activity was flagged by researchers at Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team. Their findings point to a supply-chain style attack, where the trusted update channel becomes the weapon. You're not tricked into visiting a shady site. You're using the official updater, doing the responsible thing, and still getting burned. > "The scariest attacks don't ask you to click anything suspicious. They hide inside the tools you already trust." ### What This Means for Your Setup If you run backup software on Windows, this is a good moment to rethink a few habits: - Don't assume "official updater" always equals "safe." Verify version numbers and file signatures when you can. - Stagger your update checks. If something looks off, wait and re-check rather than forcing it through. - Keep offline or cold backups of anything critical, so a compromised machine can't wipe your only copy. - Watch vendor advisories closely for the weeks after any update-server incident. ### The Bigger Lesson This story isn't really about one backup app. It's about a weak spot that lives in almost every piece of software you own: the update pipeline. When attackers can touch that, they don't need to fool you at all. They just need a few quiet minutes. So the next time an update prompt pops up, take a breath. Check where it's coming from. And keep a backup that doesn't depend on any server at all.