[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwDBDdS-bi64oe1WOT7K6lfLv3Qujd_sSSDYpPyAqr3o":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"93315586-e51d-4d02-b80f-76974d69c4f9","Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor","attackers-tampered-with-aomei-backupper-s-update-servers-for-minutes-to-deliver--ffdcab","Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis","Attackers exploited a weakness in AOMEI Backupper's update mechanism, tampering with server files for brief periods between May and July 2026 to deliver a backdoor. The attack was opportunistic, targeting any system that checked for updates during specific short windows. While AOMEI has reportedly fixed the servers, affected machines may still harbor the backdoor.","Attackers tampered with AOMEI Backupper update servers to deliver a backdoor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-tampered-with-aomei.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjhuPumyjeBRpQZo5_3mvqZ2_kXuPiOK02cH-ARofYrny0mQ2-rv55w7yBxMTBe3ymCW7c77quZ4xlkdDG9FcEhBYFr7GWmbyPE_1K1xqU0mvT-h51Z8hLg-LnWl32MeOy-aumsGO9-j8VSOSOfVUDB2k1vWOpEdyGEWV9ipF4kf3HVP1Au2ClbkYtAJrc\u002Fs1600\u002Fbackup-hacked.jpg","2026-10-16T16:43:39+00:00","2026-10-16T18:00:02.995289+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"AOMEI Backupper","product",{"name":21,"type":22},"AOMEI Technology","vendor",{"name":24,"type":19},"AnyViewer",{"name":26,"type":19},"Radmin",{"name":28,"type":29},"UNC7017","threat_actor",{"name":31,"type":19},"CROSSROAD","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58],{"type":52,"value":53,"context":54},"mitre_attack","T1195.002","Compromise of software supply chain",{"type":52,"value":56,"context":57},"T1059.003","Windows Command Shell",{"type":52,"value":59,"context":60},"T1053.005","Scheduled Task\u002FJob",[21,18,24],{"controls":63,"vendors":149},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":94,"name":95,"problem":96,"products":97},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":123,"name":124,"problem":125,"products":126},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[127,133,141],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[150],{"slug":151,"name":152,"logo_path":153,"roles":154},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":173},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","Attackers compromised AOMEI Backupper's software update infrastructure, briefly replacing legitimate update files with a backdoor payload during narrow windows across several months in 2026. This is a classic supply chain attack: users who trusted the vendor's update mechanism became unwitting victims simply by keeping their software current — an action they were supposed to take for security. The brevity of each tampering window suggests the attackers deliberately minimized exposure to evade detection, highlighting how even short-lived compromises can have lasting consequences since implanted backdoors persist after the server is cleaned. Organizations relying on third-party backup software must recognize that the software supply chain itself is an attack surface, not a trusted safe harbor.",[161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 SA-9: External System Services","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","NIST CSF ID.SC-4: Supplier Monitoring","ITIL: Change and Release Management – Pre-deployment Validation","GDPR Article 32: Security of Processing (integrity controls on software handling personal data)",{"CIS Control 10: Malware Defenses":174,"NIST CSF ID.SC-4: Supplier Monitoring":175,"NIST SP 800-53 IR-4: Incident Handling":176,"CIS Control 16: Application Software Security":177,"NIST SP 800-53 SA-9: External System Services":178,"CIS Control 7: Continuous Vulnerability Management":179,"NIST CSF DE.CM-7: Monitoring for Unauthorized Activity":180,"CIS Control 2: Inventory and Control of Software Assets":181,"NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management":182,"ITIL: Change and Release Management – Pre-deployment Validation":183,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":184,"GDPR Article 32: Security of Processing (integrity controls on software handling personal data)":185},"Endpoint malware defences give a chance to catch the backdoor dropped by the tampered update, even though it arrived through a trusted channel.","Supplier monitoring helps you learn quickly when a vendor such as AOMEI has had its update infrastructure compromised.","Incident handling guides finding and cleaning machines that received the backdoored update during the short tampering windows.","Secure software development includes protecting build and update pipelines, the infrastructure attackers hijacked to swap in the backdoor.","Requires overseeing the security of external services, including a vendor's update servers that push code onto your systems.","Ongoing vulnerability and patch tracking includes checking whether updates themselves are trustworthy, as the hijacked AOMEI updates were not.","Monitoring for unauthorised software and connections can expose the backdoor's activity after the poisoned update was installed.","A software inventory shows which machines run AOMEI Backupper, so the affected installs can be found quickly once the update server compromise is known.","Supply chain risk management asks how vendors protect their update infrastructure, the weakness behind the AOMEI backdoored updates.","Validating updates before deployment, including in a test group, gives a chance to spot a tampered AOMEI release before it reaches every machine.","Integrity checks such as code signing verification would flag update files that do not match the vendor's genuine release.","Requires measures to protect the integrity of systems handling personal data, which a backdoored backup tool directly undermines."]