Attackers rewrote the files AOMEI Backupper pulls from the vendor’s own update servers, in bursts of five to ten minutes spread across May and July 2026, so any Windows machine that happened to check for updates inside those slots installed a backdoor.
Google’s threat intelligence group and Mandiant confirmed three windows: May 28 from 05:40 to 05:50 UTC, July 16 from 08:33 to 08:39, and July 20 from 10:35 to 10:40. Copies that polled outside those minutes received clean files, which is what made the campaign so hard to spot.
No software flaw was involved and the victim did nothing wrong. Two text files govern the updater. One names the package and the checksum meant to prove it is genuine; the other tells the pop-up service what to run. Neither carries a cryptographic signature, and the checksum sits inside the very file it validates.
Who got hit
GTIG saw affected organizations in IT services, telecoms and higher education across eleven countries, among them the US, UK-adjacent European markets, India, Singapore, Brazil and South Africa. It gave no total and said the real figure is probably larger.
The targeting was opportunistic rather than selective. SecOps teams should hunt for dllhost.exe spawning from the Backupper directory, treat every install that auto-updated between May and July as suspect, and rebuild from known-good media. AOMEI’s remote desktop tool AnyViewer shares the same update path.
