Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Attackers repeatedly modified the update files that AOMEI Backupper software retrieves from its own servers, doing so in brief periods ranging from five to ten minutes between May and July 2026. If a user's copy of the backup program checked for updates during any of those windows, it would download and run a malicious backdoor.
Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab disclosed this campaign, stating that AOMEI has reported addressing the issue, but the patch does not remove the backdoor from already-infected machines. AOMEI Backupper is backup and disk-cloning software developed by AOMEI Technology, a Hong Kong-based vendor.
The software features background services that routinely check AOMEI's servers over HTTPS for updates and promotional pop-ups. The program does not perform cryptographic verification of either the update file or the notification file, which specifies what the pop-up displays and executes. The security flaw lies in the lack of these crucial checks, and no user interaction was required beyond the software's installation and active operation.
The attackers only needed to alter two text files on the server for a short duration. Once the compromised software checked for updates during one of these windows, it downloaded and executed the malicious backdoor, running with the privileges of the AOMEI process that initiated it. The three tampering windows identified by GTIG and Mandiant, potentially more incidents going unreported, affected copies of the software that checked for updates during those specific intervals.
Affected organizations span across 11 countries, including IT services, telecommunications, and higher education sectors. The remote-desktop tool AnyViewer is reported to use the same update mechanism as Backupper. The attackers employed the group name UNC7017 and remain unnamed. The supply chain compromise is considered unique due to its nature, evading traditional point-in-time detection and automated file scanning.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
