AOMEI Backupper users
How they got in, as reported. A supplier or vendor that was compromised first.
← All cases- Date
- 16 Oct 2026
- Place
- Hong Kong
- Who
- AOMEI Backupper users
- The way in
- Vendor compromise
- Source
- The Hacker News
What was reported.
Threat actors compromised AOMEI Technology's update servers to intermittently deliver backdoors to systems running AOMEI Backupper software. The opportunistic supply-chain attack affected organizations across 11 countries, including the United States, spanning IT services, telecommunications, and higher education.
The way in the source reports: a supplier or vendor that was compromised first.
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.The Hacker News, added to these pages on 17 Oct 2026. The source
What a vendor compromise is.
A vendor compromise starts at a supplier. An attacker gets into a provider first and reaches its customers through the access or the trust the provider already has.
A message from a real supplier's real mailbox asking to change bank details is the common form. Software updated by a provider the attacker controls is another.
We read a supplier's own public mail records: whether forged mail in its name would be refused and whether look-alikes of its name are registered.
A reading of public records cannot see inside the supplier's systems. A changed bank detail is confirmed by a call to a number already on file, never by a reply.
This part is true of every case of this kind. It says nothing more about AOMEI Backupper users than the source does.
What we check for it.
The outside services your domain depends on.
If this happens at your firm.
- Confirm every change of bank details on a number you already hold, even inside a real email thread.
- Agree with your main suppliers how a change of bank details is confirmed and keep it in writing.
What we read for technology companies.
- The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
- Breach records for addresses at your own domain, read externally; nothing inside is touched.
- Web addresses an attacker could register to look like yours, each checked: is it registered, is it set up for mail.
- The certificate your website answers with, seen externally: its name, its dates and who issued it.
- The headers and cookies your website sends to every visitor, seen externally.
- Read with the assessment. What AI assistants answer about your business. Assistants build their answers from pages they crawl. A look-alike address an attacker could register can be built to be crawled: its robots file invites the AI crawlers in and its page claims your name. When a client asks an assistant for your phone number, they can get the copy's. In 2025, asked for the sign-in pages of 50 brands, an AI assistant gave addresses the brand did not control one time in three. The check is built to ask six assistants: Claude, ChatGPT search, Gemini, Perplexity, Grok and Copilot, through Bing. Monitoring asks again every week and tells you when a copy's phone or address is in an answer. Source: Netcraft research, read on 4 November 2026.
The rule, from its source: What does each US state's data breach law ask a business to do?
See your own firm the way an attacker reads it.
We read your domain from public records and show each way in with a check anyone can re-run.
Source.
Source: The Hacker News ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.