Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
Between May and July 2026, attackers intermittently modified files on AOMEI Backupper's update servers to deliver a backdoor to Windows systems updating during specific periods, representing a supply-chain compromise.
Why it matters
This incident highlights the risk posed by trusted software update infrastructure being compromised and delivering malicious code, which can lead to widespread infection.
SOC impact
Monitor for indicators of compromise related to the AOMEI Backupper update process. Investigate any suspicious update activity and identify systems that applied updates during the affected time frame. Analyze endpoint telemetry for signs of the delivered backdoor.
Recommended actions
- Identify assets running AOMEI Backupper software
- Review update logs for activity between May and July 2026
- Investigate endpoint alerts correlated with update time windows
- Monitor network traffic for unusual connections post-update
- Consult The Hacker News report for detailed indicators and updates
Executive Summary
Between May and July 2026, attackers intermittently tampered with the AOMEI Backupper update servers to deliver a backdoor payload to Windows systems during specific update intervals. This form of supply-chain compromise leverages trusted backup software as a delivery vector, potentially affecting a broad user base. Operational teams must be vigilant for suspicious update activity and investigate systems that received updates in the affected periods. Monitoring related telemetry is critical to detect and respond to potential backdoor infections from this incident.
SOC Impact
Monitor for indicators of compromise related to the AOMEI Backupper update process. Investigate any suspicious update activity and identify systems that applied updates during the affected time frame. Analyze endpoint telemetry for signs of the delivered backdoor.
Identification of Affected Systems and Update Process Monitoring
- Identify assets running AOMEI Backupper software
- Review update logs for activity between May and July 2026
- Investigate endpoint alerts correlated with update time windows
- Monitor network traffic for unusual connections post-update
- Consult The Hacker News report for detailed indicators and updates
Why It Matters
This incident highlights the risk posed by trusted software update infrastructure being compromised and delivering malicious code, which can lead to widespread infection.