Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Reported by The Hacker News ([email protected] (The Hacker News))

Summary by Cyber Security News16 Oct 2026, 18:43 CEST

About this summary. This is a short, independently written summary of an article first published by The Hacker News. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Investigating Ephemeral Supply Chain Tampering

Google security advisory (AV26-1060)

Chrome Dev for Desktop Update

Chrome Beta for Desktop Update

Chrome for Android Update

Google security advisory (AV26-1045)