AOMEI Backupper Update Servers Tampered to Deliver Backdoor

· Cybersecurity

Attackers repeatedly altered the files that AOMEI Backupper downloads from the vendor's own update servers, according to research from Google, in windows of five to ten minutes at a time between May and July 2026. Any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Because the tampering happened on the vendor's legitimate infrastructure and only briefly, it was hard to detect and would have affected users who did nothing more than allow the software to update itself. The case is another example of attackers targeting the software update pipeline rather than individual victims, and it puts backup tools, which typically run with high privileges, in the spotlight as a route to deeper network access.

Why it matters：It reinforces that vendor update channels remain a high-value attack surface, and that backup software, often highly privileged, is an attractive foothold for intruders.

Key points

  • Tampering occurred in five-to-ten-minute windows between May and July 2026.
  • Only users who checked for updates during those windows were affected.
  • The malicious payload was a backdoor delivered through the legitimate updater.

Sources (original reporting)

More stories from this day