Researchers disclosed a supply chain campaign where attackers repeatedly modified update files fetched by AOMEI Backupper from official servers between May and July 2026.
The software checked updates over HTTPS without cryptographic verification, impacting organizations across eleven countries.
How the trap was set
The AOMEI Backupper program, used for backups on Windows computers, regularly communicates with the company's servers to check for new data.
Security researchers from Google and other companies discovered that unknown attackers managed to break into systems and change files for just a few minutes at a time, on three separate occasions between May and July 2026. Specifically, the intrusions were recorded on May 28 for a few minutes, on July 16 for six minutes, and on July 20 for five minutes.
Any computer that happened to check for updates at those exact few-minute intervals automatically downloaded a dangerous program along with the regular files, without realizing it.
READ ALSO
Mammoth $9,6 million fine in Norway for Grindr data
What was happening on the infected computers?
When the computer downloaded the attackers' package, a remote administration tool was secretly installed, allowing unknown parties to gain remote access and control over the system. In addition, a scheduled task was created on the computer to regularly execute code, while the original installer took care to delete itself to leave no trace.
In one of the attacks, the attackers used a method that didn't even require the execution of a program. Through an automatic login, they were able to send the user's digital login ID to the attackers' address, exposing sensitive data without the user seeing anything on their screen.
Who was affected and what happens now?
The investigations showed that organizations in eleven countries were affected, including the United States, India, South Africa, Portugal, Spain and Brazil, covering sectors such as telecommunications, higher education and IT services.
The researchers notified the company, which said it had taken steps to secure its servers. However, experts stress that this action does not remove the dangerous software from computers that had already been infected during the attacks.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)