Hijacked AOMEI Backupper Updates Leave Backdoor on PCs in 11 Countries
Attackers briefly seized control of AOMEI Backupper’s update servers in 5–10‑minute bursts, pushing a backdoored update to Windows PCs that checked in during those windows. Organizations in 11 countries were affected, and although AOMEI says the servers are fixed, any machine that installed the tainted update remains compromised until cleaned.
A short window of attacker control over a backup tool’s update servers has turned into a long‑term security problem for organisations on three continents.
According to technical reporting, unknown attackers tampered with AOMEI Backupper’s update infrastructure in a series of 5–10‑minute bursts. During those intervals, Windows PCs that queried the servers for legitimate AOMEI Backupper updates received a malicious package carrying a backdoor instead.
The incident has hit organisations across 11 countries. The full scope is still being established, but the vector — poisoning a trusted software update channel — means victims likely include entities that believed they were following good security practice by keeping backup software current.
AOMEI has said its servers have now been fixed. That closes the immediate hole in the update process but doesn’t remove the payload already delivered. Any PC that installed the compromised update while the attackers controlled the servers remains exposed until it is identified and remediated.
Backup tools like AOMEI Backupper typically run with broad system privileges so they can copy all files and system states. A backdoor delivered through that software can inherit those privileges, allowing intruders to access or alter large volumes of data and potentially move laterally across networks.
The method places this incident in the category of software supply‑chain attacks, where attackers weaponise legitimate update mechanisms. There is no public attribution yet to any specific group or state, and no public confirmation of which sectors have been hardest hit.
For affected organisations, the immediate tasks are to determine which systems pulled updates during the tampered windows, check for indicators of compromise, and clean or rebuild any backdoored hosts. How quickly AOMEI and national cybersecurity agencies can provide detailed guidance will determine whether this intrusion remains contained or becomes a base for follow‑on attacks.
Key developments to watch include formal advisories listing affected versions, technical details of the backdoor, and any attribution linking the operation to a known threat actor.
Sources
- OSINT