Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers compromised AOMEI Backupper's software update infrastructure, briefly replacing legitimate update files with a backdoor payload during narrow windows across several months in 2026. This is a classic supply chain attack: users who trusted the vendor's update mechanism became unwitting victims simply by keeping their software current — an action they were supposed to take for security. The brevity of each tampering window suggests the attackers deliberately minimized exposure to evade detection, highlighting how even short-lived compromises can have lasting consequences since implanted backdoors persist after the server is cleaned. Organizations relying on third-party backup software must recognize that the software supply chain itself is an attack surface, not a trusted safe harbor.