# Researchers disclose brief AOMEI update-server attacks that installed backdoors

_Published Friday, October 16, 2026 at 2:16 PM EDT · Security · Latest · Tier 2 — Notable_

![Researchers disclose brief AOMEI update-server attacks that installed backdoors — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhuPumyjeBRpQZo5_3mvqZ2_kXuPiOK02cH-ARofYrny0mQ2-rv55w7yBxMTBe3ymCW7c77quZ4xlkdDG9FcEhBYFr7GWmbyPE_1K1xqU0mvT-h51Z8hLg-LnWl32MeOy-aumsGO9-j8VSOSOfVUDB2k1vWOpEdyGEWV9ipF4kf3HVP1Au2ClbkYtAJrc/s1700-nu-rw-lo-l85-e365/backup-hacked.jpg)

Attackers altered AOMEI Backupper's update-server files for minutes at a time between May and July 2026 to install a backdoor, researchers disclosed this week. Google Threat Intelligence Group and Mandiant identified affected organizations in IT services, telecommunications and higher education across 11 countries.

The Windows backup program fetched unsigned configuration files that specified both the download and its verification checksum. Changing those files let attackers deliver and execute malicious software through normal update checks without further user action.

AOMEI told Mandiant on July 29 that it had secured its servers. That action does not remove existing infections, and ManageEngine's Threat Analysis Lab said it had not independently confirmed containment.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html)

---
Canonical: https://techandbusiness.org/newswire/_U4GMY795dy3By7RPtS-1h
Published: 2026-10-16T18:16:30.380Z
Story chronology: 2026-10-16T16:43:39.000Z
Retrieved: 2026-10-16T21:00:38.072Z
Publisher: Tech & Business (techandbusiness.org)