Supply Chain Attack on AOMEI Backupper Delivers Backdoor via Update Servers

• •Attackers exploited AOMEI Backupper's update servers to deliver a backdoor.
• •Compromised systems included organizations in 11 countries across various sectors.
• •AOMEI has fixed its servers, but affected machines still harbor the backdoor.

Between May and July 2026, attackers tampered with AOMEI Backupper's update servers, delivering a backdoor to users who checked for updates during specific time windows. The attack exploited a lack of cryptographic verification in the update process, allowing malicious files to be downloaded and executed with the same privileges as the AOMEI process. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab confirmed that organizations in IT services, telecommunications, and higher education across 11 countries, including the United States and India, were affected. AOMEI has reported fixing its servers, but the backdoor remains on already compromised machines. The attack was opportunistic, targeting any system that checked for updates during the tampering windows. The specific dates of tampering included May 28, July 16, and July 20, 2026, with the potential for more incidents not observed. The backdoor installed Radmin, a remote administration tool, alongside an attacker-built DLL, allowing further exploitation.