Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor’s own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.

Google Threat Intelligence Group, Mandiant, and ManageEngine’s Threat Analysis Lab, which disclosed the campaign this week, say AOMEI has reported fixing its servers, but that fix does not remove the backdoor from machines that were already hit.

AOMEI Backupper is Windows backup and disk-cloning software made by AOMEI Technology, a vendor registered in Hong Kong. Like the company’s remote-desktop tool AnyViewer, it runs background services that regularly check AOMEI’s servers over HTTPS for software updates and promotional pop-ups.