Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Summary: Attackers altered the two text files AOMEI Backupper fetches from the vendor's own update servers in five-to-ten-minute windows between May and July 2026, so copies that checked for updates during those windows downloaded and ran a backdoor. Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab found the program does not cryptographically verify either file, and AOMEI's fix to its servers does not remove the backdoor from machines already hit.
What you should know: GTIG identified affected organizations in IT services, telecommunications and higher education across 11 countries and said the real number is likely higher, while the downloader restored the local update file to its genuine contents so an infected machine can look normal and the vendor's download page looks clean almost all the time.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026