AOMEI Backupper Update Servers Compromised in Targeted Backdoor Campaign

AOMEI Backupper Update Servers Compromised in Targeted Backdoor Campaign

In a sophisticated supply chain attack, unknown adversaries repeatedly tampered with the update servers of AOMEI Backupper, a popular Windows backup and recovery tool, to deliver a backdoor to users who checked for updates during specific time windows. The campaign, which occurred between May and July 2026, was disclosed by Google Threat Intelligence Group (GTIG), Mandiant, and ManageEngine's Threat Analysis team. According to a report from The Hacker News, the attackers modified the files fetched by the software's update mechanism for only five to ten minutes at a time, minimizing the window of exposure and complicating detection.

How the Attack Unfolded

The attack leveraged AOMEI Backupper's legitimate update process. When a user initiated an update check, the software would contact AOMEI's official update servers to download the latest version. The attackers managed to alter the files hosted on those servers, replacing the legitimate installer with a trojanized version that contained a backdoor. Because the malicious files were only present for brief periods—often just minutes—most users who checked for updates outside those windows received the legitimate software. This "hit-and-run" approach is a hallmark of advanced persistent threat (APT) groups seeking to evade detection and avoid widespread fallout.

The backdoor itself, once installed, provided the attackers with persistent remote access to the victim's machine. Details on the specific capabilities of the backdoor are still emerging, but such malware typically allows for data exfiltration, lateral movement within a network, and the installation of additional payloads. The targeted nature of the campaign suggests that the attackers were not after mass compromise but rather specific high-value victims.

Attribution and Impact

The investigation, conducted jointly by GTIG, Mandiant, and ManageEngine's Threat Analysis team, has not yet publicly attributed the attack to a known threat actor. However, the precision and operational security demonstrated—such as the short-lived server modifications—point to a well-resourced and sophisticated group. The number of affected users remains unclear, but the limited time windows likely mean that only a small subset of AOMEI Backupper users were impacted.

AOMEI has since been notified and is believed to have taken steps to secure its update infrastructure. The company has not released an official statement, but users are advised to ensure their software is updated to the latest version and to verify the integrity of any recent downloads. It is also recommended to monitor for signs of compromise, such as unusual network traffic or unexpected system changes.

The Growing Threat of Supply Chain Attacks

This incident is the latest in a series of supply chain attacks targeting software update mechanisms. In recent years, attackers have increasingly focused on compromising trusted vendors to distribute malware, as seen in high-profile cases like SolarWinds, 3CX, and MOVEit. These attacks are effective because they exploit the trust users place in legitimate software and can bypass traditional security controls.

Organizations can mitigate the risk by implementing strict update policies, such as verifying digital signatures and hashes of downloaded updates, and by using network monitoring to detect anomalous connections. Additionally, employing endpoint detection and response (EDR) solutions can help identify and block malicious activity post-infection. For critical software like backup tools, which often have extensive access to system data, extra vigilance is warranted.

What Users Should Do

If you use AOMEI Backupper, consider the following steps:
- Check for updates manually from the official website rather than relying solely on the in-app updater, and verify the digital signature of the installer.
- Scan for indicators of compromise using updated antivirus and EDR tools. Look for unusual processes, scheduled tasks, or network connections.
- Review logs for any update activity during the May–July 2026 timeframe, especially if you initiated updates during that period.
- Stay informed by following advisories from AOMEI and security researchers.

The attackers' ability to modify files on AOMEI's update servers also raises questions about the security of the vendor's infrastructure. It is unclear whether the compromise was due to stolen credentials, a vulnerability in the update server, or an insider threat. AOMEI will need to conduct a thorough forensic investigation to prevent future incidents.

Conclusion

The AOMEI Backupper supply chain attack highlights the ingenuity and patience of modern cyber adversaries. By striking only for minutes at a time, they reduced their footprint and made detection a needle-in-a-haystack problem. As software supply chains remain a prime target, both vendors and users must adopt a zero-trust mindset toward updates, verifying integrity at every step. The full technical details are expected to be released in a forthcoming report from GTIG and Mandiant.

For more information, refer to the original article on The Hacker News.