Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly hijacked AOMEI Backupper's update servers in windows as short as five minutes, delivering a backdoor to any client that auto-updated — a supply-chain technique that challenges conventional detection timelines.
Summary written by editorial AI · Source link below
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.
Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Editorial Analysis
Ephemeral supply-chain poisoning via vendor update infrastructure can bypass traditional monitoring; enterprises must treat every auto-update channel as a potential attack vector.
Audit all third-party software update mechanisms for code-signing verification and consider staging updates with integrity checks before deployment.
Attackers compromised a backup vendor's update servers in brief windows, backdooring customers who auto-updated — a supply-chain risk applicable to any enterprise software.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d