Backup software is one of the most trusted programs on any business computer. It runs quietly in the background, it can read almost every file, and it updates itself. That trust is exactly what attackers went after in a newly disclosed attack on AOMEI Backupper, a popular Windows backup program.
What happened
According to researchers from Google Threat Intelligence Group, Mandiant and ManageEngine, attackers repeatedly changed the files that AOMEI Backupper downloads from the vendor’s own update servers. Each change lasted only five to ten minutes at a time, and it happened on and off between May and July 2026. Any copy of the program that checked for an update during one of those short windows downloaded and ran a backdoor instead of a normal update.
The short windows matter. A tampered file that is only there for a few minutes is much harder for the vendor, or anyone else, to notice. It also means not every AOMEI user was affected, only machines that happened to update at the wrong moment.
Why this matters for a small business
Most of us are told, correctly, to keep software updated. This attack did not trick anyone into clicking a link. It came through the normal, trusted update channel. Nobody did anything wrong, which is why this type of attack is so effective.
What to do this week
- Check whether you use AOMEI Backupper on any office PC, laptop or server.
- If you do, treat machines that updated between May and July 2026 as worth checking. Have your IT provider review them, rather than just uninstalling and hoping for the best.
- Keep at least one backup copy that is offline or cannot be changed, so a compromised backup tool cannot take your recovery option with it.
- Keep a simple list of the software installed on your business computers. When news like this breaks, you can answer “are we affected?” in minutes instead of days.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.