Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly hijacked AOMEI Backupper's update servers in windows as short as five minutes, delivering a backdoor to any client that auto-updated — a supply-chain technique that challenges conventional detection timelines.
Summary written by editorial AI · Source link below
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.
Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Editorial Analysis
Ephemeral supply-chain poisoning via vendor update infrastructure can bypass traditional monitoring; enterprises must treat every auto-update channel as a potential attack vector.
Audit all third-party software update mechanisms for code-signing verification and consider staging updates with integrity checks before deployment.
Attackers compromised a backup vendor's update servers in brief windows, backdooring customers who auto-updated — a supply-chain risk applicable to any enterprise software.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d