AOMEI Backupper Update Servers Hijacked to Distribute Backdoor
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised AOMEI Backupper's software update infrastructure, briefly replacing legitimate update files with a backdoor payload during narrow windows across several months in 2026. This is a classic supply chain attack: users who trusted the vendor's update mechanism became unwitting victims simply by keeping their software current — an action they were supposed to take for security. The brevity of each tampering window suggests the attackers deliberately minimized exposure to evade detection, highlighting how even short-lived compromises can have lasting consequences since implanted backdoors persist after the server is cleaned. Organizations relying on third-party backup software must recognize that the software supply chain itself is an attack surface, not a trusted safe harbor.
Tactical Insight
Immediate actions
- Audit all endpoints that ran AOMEI Backupper updates between May and July 2026 for signs of backdoor installation.
- Isolate potentially compromised systems from the network pending forensic investigation and reimaging.
- Force-rotate credentials and revoke tokens on any system that received updates during the affected windows.
Long-term improvements
- Implement cryptographic code-signing verification for all software updates so tampered binaries are rejected before execution.
- Establish a vendor risk management program that requires third-party software vendors to attest to the integrity of their update pipelines.
- Deploy application allowlisting so only approved, hash-verified binaries can execute on endpoints.
Detection measures
- Enable integrity monitoring (FIM) on endpoints to alert when backup or update agent binaries are modified unexpectedly.
- Centralize and retain logs of all software update events, including the exact binary hash and source URL, to enable rapid retrospective analysis.
- Set up network-level behavioral analytics to flag unusual outbound connections originating from backup software processes.