The recently disclosed supply chain attack targeting AOMEI Backupper demonstrates how attackers can compromise enterprise systems without exploiting a conventional software vulnerability or persuading users to download malicious applications.

Researchers from Google Threat Intelligence Group, Mandiant and ManageEngine discovered that attackers repeatedly modified configuration files hosted on AOMEI's legitimate update servers for periods lasting just five to ten minutes.

Any installation checking for updates during these brief windows could receive malicious instructions and download attacker-controlled software.

What makes this attack particularly concerning is that the compromised content was delivered through the software's normal update mechanism over HTTPS.

The attackers did not need to compromise the application binary itself. Instead, they modified two configuration files, down_html.ini and Notifycfg.ini, which controlled update downloads and notification behavior.

These files were not cryptographically authenticated. Even the checksum used to verify the downloaded package was supplied through the same untrusted configuration file.

As a result, attackers who could modify the configuration could also replace the expected checksum, allowing malicious content to appear valid.

The attack delivered a multi-stage malware chain involving the CROSSROAD downloader and SHINYROAD backdoor. The malware established persistence and provided attackers with remote command execution capabilities.

Researchers also observed a separate technique involving a hidden WebDAV request capable of exposing Windows authentication material without requiring additional malware execution.

Perhaps the most significant aspect of this campaign was its timing.

The attackers restored the legitimate update files after each short exploitation window. Security teams examining the vendor's servers later would find normal files, potentially leading them to conclude that the original detection was a false alarm.

This creates a serious challenge for conventional security investigations that rely on examining the current state of a website, download server or application.

A clean server today does not prove that malicious content was never served yesterday.

The incident also raises important concerns about backup and recovery infrastructure.

Backup software frequently operates with elevated privileges and may have access to sensitive files, storage systems and recovery environments. Compromising such software can therefore provide attackers with an especially valuable entry point.

Organizations should ensure that software updates are cryptographically signed, update metadata is authenticated and installation privileges are appropriately restricted.

Security teams should also monitor unexpected child processes, scheduled tasks, outbound connections and unusual behavior originating from trusted applications.

Most importantly, organizations using affected AOMEI software must investigate possible endpoint compromise even if the vendor has already secured its update servers.

The broader lesson is that trust in a software vendor must not automatically translate into trust in every file delivered by that vendor's infrastructure.

Supply chain security requires verifying what software is downloaded, how its authenticity is established and what it is permitted to execute.

A five-minute compromise of an update server can create a security incident that persists for months.

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis

Source: Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor via The Hacker News — published 16 Oct 2026.