AOMEI Backupper Update Servers Hijacked to Distribute Backdoor
Attackers compromised AOMEI Backupper's software update infrastructure, briefly replacing legitimate update files with a backdoor payload during narrow windows across several months in 2026. This is a classic supply chain attack: users who trusted the vendor's update mechanism became unwitting victims simply by keeping their software current — an action they were supposed to take for security. The brevity of each tampering window suggests the attackers deliberately minimized exposure to evade detection, highlighting how even short-lived compromises can have lasting consequences since implanted backdoors persist after the server is cleaned. Organizations relying on third-party backup software must recognize that the software supply chain itself is an attack surface, not a trusted safe harbor.
Tactical Insight
Immediate actions
- Audit all endpoints that ran AOMEI Backupper updates between May and July 2026 for signs of backdoor installation.
- Isolate potentially compromised systems from the network pending forensic investigation and reimaging.
- Force-rotate credentials and revoke tokens on any system that received updates during the affected windows.
Long-term improvements
- Implement cryptographic code-signing verification for all software updates so tampered binaries are rejected before execution.
- Establish a vendor risk management program that requires third-party software vendors to attest to the integrity of their update pipelines.
- Deploy application allowlisting so only approved, hash-verified binaries can execute on endpoints.
Detection measures
- Enable integrity monitoring (FIM) on endpoints to alert when backup or update agent binaries are modified unexpectedly.
- Centralize and retain logs of all software update events, including the exact binary hash and source URL, to enable rapid retrospective analysis.
- Set up network-level behavioral analytics to flag unusual outbound connections originating from backup software processes.