Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers tampered with AOMEI Backupper's update servers between May and July 2026, altering files in five-to-ten-minute windows so that any Windows backup program checking for updates during those periods would download and execute a backdoor. The compromise was identified by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis, highlighting the risks of supply-chain attacks on software update mechanisms.