Attackers gained access to AOMEI Backupper’s update servers and briefly replaced legitimate software files with malicious versions during three confirmed windows between May and July 2026. The tampering lasted only five to ten minutes each time, but any computer that checked for updates during those periods downloaded and installed a backdoor. Google Threat Intelligence Group and Mandiant confirmed the attack, while AOMEI has stated it secured its servers, though infected machines remain compromised since the fix does not remove already-installed backdoors.
The attack exploited weaknesses in how the backup software verified updates, as it did not cryptographically validate downloaded files. Affected organizations across eleven countries in IT services, telecommunications, and higher education received malicious packages containing remote access tools and implants that gave attackers command-line control. Security researchers emphasize that organizations cannot assume protection simply because the vendor fixed its servers and warn that checking current download pages will not reveal past compromises, as the malicious files were only present for minutes before being replaced with legitimate ones.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
