Security · Updated 16 Oct, 10:13 pm IST
Attackers used AOMEI Backupper update servers to deliver backdoor in short windows
Why it matters for readers: Explains how attackers can hijack software updates by changing simple text files on a server without exploiting code bugs.
- Attackers changed the files that AOMEI Backupper fetches from its update servers in five-to-ten-minute windows between May and July 2026 so copies checking for updates then would download a backdoor.1
- Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab disclosed the campaign and reported that AOMEI has fixed its servers.1
- The fix on the servers does not remove the backdoor from machines that were already infected.1
- No software vulnerability was exploited and no user action was needed beyond having AOMEI Backupper installed and running.1
- Two unsigned files used by the updater, down_html.ini and Notifycfg.ini, are not cryptographically verified and contain the checksum and instructions attackers altered.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started