As cited
Copy frozen at (site build).
threat intel
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Between May and July 2026, attackers gained access to AOMEI Backupper's update servers and replaced legitimate update files with backdoored versions during brief five- to ten-minute windows. Users who checked for updates during these compromised periods unknowingly downloaded and executed malicious code. The attack was discovered by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team.
Why it matters: Organizations running AOMEI Backupper may have downloaded and executed a backdoor if they checked for updates during the attack window; verify installation integrity, review logs for indicators of compromise (IOCs), and assume potential system compromise if updates were installed during May through July 2026.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Between May and July 2026, attackers gained access to AOMEI Backupper's update servers and replaced legitimate update files with backdoored versions during brief five- to ten-minute windows. Users who checked for updates during these compromised periods unknowingly downloaded and executed malicious code. The attack was discovered by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team.
Why it matters: Organizations running AOMEI Backupper may have downloaded and executed a backdoor if they checked for updates during the attack window; verify installation integrity, review logs for indicators of compromise (IOCs), and assume potential system compromise if updates were installed during May through July 2026.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Between May and July 2026, attackers gained access to AOMEI Backupper's update servers and replaced legitimate update files with backdoored versions during brief five- to ten-minute windows. Users who checked for updates during these compromised periods unknowingly downloaded and executed malicious code. The attack was discovered by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team.
Why it matters: Organizations running AOMEI Backupper may have downloaded and executed a backdoor if they checked for updates during the attack window; verify installation integrity, review logs for indicators of compromise (IOCs), and assume potential system compromise if updates were installed during May through July 2026.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Between May and July 2026, attackers gained access to AOMEI Backupper's update servers and replaced legitimate update files with backdoored versions during brief five- to ten-minute windows. Users who checked for updates during these compromised periods unknowingly downloaded and executed malicious code. The attack was discovered by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team.
Why it matters: Organizations running AOMEI Backupper may have downloaded and executed a backdoor if they checked for updates during the attack window; verify installation integrity, review logs for indicators of compromise (IOCs), and assume potential system compromise if updates were installed during May through July 2026.
- Source published
- First seen by Cybersecurity Tracker