Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Overview
Between May and July 2026, attackers gained access to the update servers of AOMEI Backupper, a Windows backup program, and altered the files available for download. For brief periods of five to ten minutes, any user checking for updates during these windows inadvertently downloaded a backdoor that could compromise their systems. This incident poses a significant risk as it affects users who rely on AOMEI Backupper for data backup and recovery, potentially leading to unauthorized access to sensitive information. Security researchers from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis have raised alarms about this security breach, emphasizing the importance of vigilance when downloading updates from software vendors. Users are urged to verify the integrity of updates and consider additional security measures to protect their systems.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: AOMEI Backupper
- Action Required: Users should verify updates before installation and consider using endpoint protection solutions to monitor for suspicious activities.
- Timeline: Ongoing since May 2026
Original Article Summary
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Impact
AOMEI Backupper
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since May 2026
Remediation
Users should verify updates before installation and consider using endpoint protection solutions to monitor for suspicious activities.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Windows, Microsoft, Google, and 1 more.