AOMEI Backupper Update Servers Briefly Hijacked to Push a Backdoor to Windows Users

Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab have disclosed a campaign in which attackers repeatedly altered files on the update servers for AOMEI Backupper, a Windows backup and disk-cloning tool. Each change lasted only five to ten minutes, between May and July 2026. Any copy of the software that checked for an update during one of those windows downloaded and ran a backdoor. GTIG and Mandiant confirmed three windows and believe more probably occurred that they did not see.

No software flaw was exploited, and users did not need to do anything beyond having the program installed and running. The attackers only had to change two text files on the server. The software did not cryptographically verify either file, and the checksum meant to prove a download was genuine sat inside the same unsigned file that named it. On the machines examined, the malicious package ran with the privileges of the AOMEI process and could install software across the whole system, though the lab said this depended on how the AOMEI service was running.

Only copies that checked in during a window were affected, while those that checked before or after received genuine files, which makes the attack hard to spot. GTIG described the targeting as opportunistic. AOMEI has reported fixing its servers, but that does not remove the backdoor from machines already compromised.