Hackers reportedly compromised AOMEI’s servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.
The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems.
Researchers at ManageEngine’s Threat Analysis Lab (METAL), working with Google’s Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks.






