Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Between May and July 2026, attackers repeatedly tampered with AOMEI Backupper's official update servers in short windows of five to ten minutes at a time. Any instance of the Windows backup software that checked for updates during these windows would download and execute a backdoor. The attack represents a classic supply chain compromise targeting the software update mechanism of a trusted vendor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team were involved in investigating the incident. The brevity of the attack windows suggests the attackers were attempting to minimize detection while still achieving broad distribution through legitimate update channels.