{"id":38269,"date":"2026-10-31T06:27:35","date_gmt":"2026-10-31T06:27:35","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/en\/?p=38269"},"modified":"2026-11-05T06:30:20","modified_gmt":"2026-11-05T06:30:20","slug":"attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor","title":{"rendered":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">For a few minutes at a time between May and July 2026, AOMEI Backupper\u2019s own servers instructed the software to install a backdoor. Google\u2019s threat researchers and other security teams disclosed the campaign on October 19. Each tampering window <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">lasted only five to ten minutes<\/a> before the attacker restored the original files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AOMEI Backupper is a widely used Windows backup and disk-cloning tool with a free edition, the kind of utility that often lands on work machines without going through IT. Rather than exploiting a flaw in the software, the attacker edited two text files on AOMEI\u2019s servers and let every copy that checked in during those minutes download and run the payload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AOMEI has since secured its servers and <a href=\"https:\/\/www.aomeitech.com\/company\/investigating-ephemeral-tampering.html\">shipped an update that signs<\/a> the configuration files, but neither fix reaches machines that were already infected.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Two Text Files Opened the Door<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Backupper runs background services that regularly contact AOMEI\u2019s servers for updates and promotional pop-ups. <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">Two configuration files drive that check<\/a>. The first, down_html.ini, names the package to download and the checksum it should match. The second, Notifycfg.ini, tells the pop-up service what to display and what to run.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Neither file is cryptographically signed, and the checksum meant to prove a download is genuine sits inside the same unsigned file. Whoever controls that file controls both the package and the proof. BleepingComputer reports that the attackers <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-hijack-aomei-update-servers-to-secretly-spread-malware\/\">abused a built-in promotional feature<\/a> to deliver the malware, so a marketing channel ended up launching code on endpoints.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers confirmed <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">three tampering windows on AOMEI\u2019s servers<\/a>: May 28 (10 minutes), July 16 (6 minutes) and July 20 (5 minutes). Copies that checked in before or after a window received clean files. Confirmed victims include <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">IT services, telecoms and higher education<\/a> organizations across 11 countries, among them Australia, the US, India and Spain, and the real number is likely higher.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those short windows also made the attack hard to investigate, since an analyst checking the vendor\u2019s download page after an alert would almost always find genuine files and could easily write off a real detection as a false positive.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1-1024x576.webp\" alt=\"\" class=\"wp-image-38265\" srcset=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1-1024x576.webp 1024w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1-300x169.webp 300w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1-768x432.webp 768w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1-800x450.webp 800w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-1.webp 1280w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Landed on Infected Machines<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On machines that pulled the tampered package, the infection chain was quiet and layered:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A downloader called CROSSROAD unpacked files into a Radmin folder under the user\u2019s local app data, created a scheduled task that runs every three hours, then deleted itself.<\/li>\n\n\n\n<li>It also restored the local update file to its genuine contents, so the machine looked normal afterward.<\/li>\n\n\n\n<li>The scheduled task launches a genuine, signed copy of Radmin, a commercial remote administration tool, which loads an attacker-built DLL placed beside it.<\/li>\n\n\n\n<li>That DLL loads SHINYROAD, an implant that provides a remote shell and can fetch and run new code on command.<\/li>\n\n\n\n<li>On some machines, the attackers later added the open-source Adaptix C2 framework, disguised as Nitro PDF software.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Radmin\u2019s own remote control features were <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">staged but never switched on<\/a>. Its signed binary served mainly as cover for the attacker\u2019s code, a familiar pattern in which attackers <a href=\"https:\/\/www.adminbyrequest.com\/en\/blogs\/how-attackers-turn-your-remote-management-tools-against-you\">turn remote management tools against you<\/a>. CROSSROAD also stopped if the machine was in China or ran certain security agents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The payload <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">ran with the AOMEI process\u2019s privileges<\/a>. On the machines researchers examined, that was enough to install software across the whole system, though it depended on how the AOMEI service was configured. Background services run with whatever rights the application was given, and few organizations monitor what those services fetch.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>The July 20 Change Needed No Code at All<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">During the July 20 window, the attackers also changed the notification file to open an invisible, one-pixel pop-up pointing to a file on an attacker\u2019s server over WebDAV.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simply rendering that pop-up <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">can make Windows send NetNTLMv2 responses<\/a> for the signed-in user to the attacker. That hashed credential can be cracked offline or reused. Because no program has to run, a machine that blocked the backdoor could still have leaked it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A leaked credential from a standard user account gives an attacker limited reach, while one from an account with local admin rights opens far more doors. Keeping standing admin rights off everyday accounts lowers what this kind of leak is worth.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Why a Server Fix Doesn\u2019t Clean Infected Machines<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AOMEI <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">told Mandiant on July 29<\/a> that it had taken corrective action. In a <a href=\"https:\/\/www.aomeitech.com\/company\/investigating-ephemeral-tampering.html\">public statement updated October 30<\/a>, the company attributes the activity to a group tracked as UNC7017 and says it moved its update service to a new server, disabled in-app promotional and automatic updates, and retired the affected download domain. It still hasn\u2019t explained how the attacker gained access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Backupper 8.5.1, released October 19, adds signature verification for the remote configuration files and separates software updates from marketing notifications. That closes the weakness behind this attack for anyone who upgrades, but the scheduled tasks and implants on infected machines stay put until someone finds and removes them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers say AnyViewer, AOMEI\u2019s remote desktop tool, uses the same update flow, though AOMEI <a href=\"https:\/\/therecord.media\/aomei-yet-to-notify-customers-hijack-software\">told The Record<\/a> its monitoring found no abnormal activity there. Organizations running either product should assume exposure until they\u2019ve checked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What to Check Now<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers urge organizations to hunt across <a href=\"https:\/\/thehackernews.com\/2026\/10\/attackers-tampered-with-aomei.html\">the entire April-to-July period<\/a>, not just the confirmed windows. Practical steps include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identifying every endpoint with AOMEI Backupper or AnyViewer installed, including copies users installed themselves<\/li>\n\n\n\n<li>Looking for scheduled tasks named RadminComponentRuntime or NitroRuntime<\/li>\n\n\n\n<li>Checking for an unsigned upgrade-now.exe carrying AOMEI\u2019s publisher details, programs running from Backupper\u2019s html pop-up folder, or unexpected files in a local Radmin app data folder<\/li>\n\n\n\n<li>Blocking the published attacker infrastructure, including storage-data[.]com and its subdomains, plus 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117<\/li>\n\n\n\n<li>Blocking outbound SMB (TCP 445) and WebDAV traffic to external addresses to stop the credential leak<\/li>\n\n\n\n<li>Running AOMEI\u2019s free Security Scanner and upgrading any remaining installs to Backupper 8.5.1<\/li>\n\n\n\n<li>Resetting Windows or domain passwords for anyone who used an affected machine<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When an alert fires, don\u2019t validate it against the vendor\u2019s download page. Preserve the files cached in the program\u2019s own folders and check network logs for the exact time of the alert.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For organizations running <a href=\"https:\/\/www.adminbyrequest.com\/en\/endpoint-privilege-management\">Admin By Request EPM<\/a>, the built-in inventory shows which endpoints have AOMEI software installed, and the audit log records installs that went through elevation, including who ran them and when. That speeds up the first step of the hunt.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2-1024x576.webp\" alt=\"\" class=\"wp-image-38266\" srcset=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2-1024x576.webp 1024w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2-300x169.webp 300w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2-768x432.webp 768w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2-800x450.webp 800w, https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/inline-2.webp 1280w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Trusted Software Still Needs Oversight<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most organizations put real effort into controlling what users install and run, but far fewer look at what that software does on its own once it\u2019s in place. As the AOMEI campaign shows, background update and notification channels give installed software a privileged path onto the endpoint that\u2019s easy to overlook.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Short of signed updates from every vendor, the practical defenses are familiar: know which utilities are on your fleet, remove the ones nobody needs, and keep standing admin rights off everyday accounts so a leaked credential is worth less.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our Endpoint Privilege Management solution routes software installs through logged, approval-ready elevation, so unvetted utilities don\u2019t pile up unnoticed. <a href=\"https:\/\/www.adminbyrequest.com\/en\/book-a-live-demo\">Book a free demo<\/a> or sign up for our lifetime <a href=\"https:\/\/www.adminbyrequest.com\/en\/freeplandownload\">free plan<\/a>, with full features for up to 25 endpoints.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.<\/p>\n","protected":false},"author":16,"featured_media":38270,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_ppma_block_editor_authors":""},"categories":[36],"tags":[628,629,148,67,68],"ppma_author":[428,559],"class_list":["post-38269","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-aomei","tag-backdoor","tag-cybersecurity","tag-pam","tag-privileged-access-management","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Pocholo Legaspi\"\/>\n\t<meta name=\"keywords\" content=\"aomei,backdoor,cybersecurity,pam,privileged access management\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Admin By Request \u00bb Local Admin Rights, Managed.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\" \/>\n\t\t<meta property=\"og:description\" content=\"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-31T06:27:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-05T06:30:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adminbyrequest\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@AdminByRequest\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@AdminByRequest\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#blogposting\",\"name\":\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\",\"headline\":\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\",\"author\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/author\\\/pocholo-editor#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/main-1.webp\",\"width\":1376,\"height\":768,\"caption\":\"Black server tower on a dark circuit-board background with glowing orange data cubes nearby.\"},\"datePublished\":\"2026-10-31T06:27:35+00:00\",\"dateModified\":\"2026-11-05T06:30:20+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage\"},\"articleSection\":\"Blogs, AOMEI, Backdoor, Cybersecurity, PAM, Privileged Access Management, Pocholo Legaspi, Paul Fisher\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/category\\\/blogs#listItem\",\"name\":\"Blogs\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/category\\\/blogs#listItem\",\"position\":2,\"name\":\"Blogs\",\"item\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/category\\\/blogs\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#listItem\",\"name\":\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#listItem\",\"position\":3,\"name\":\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/category\\\/blogs#listItem\",\"name\":\"Blogs\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#organization\",\"name\":\"Admin By Request\",\"description\":\"Local Admin Rights, Managed.\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/\",\"telephone\":\"+12622994600\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"\\\/wp-content\\\/uploads\\\/2023\\\/05\\\/Circle-Tick-24.svg\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/adminbyrequest\",\"https:\\\/\\\/twitter.com\\\/AdminByRequest\",\"https:\\\/\\\/www.instagram.com\\\/AdminByRequest\\\/\",\"https:\\\/\\\/www.tiktok.com\\\/@adminbyrequest\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCwq1wlbT9m_z3YH-EPaZqKw\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/adminbyrequest\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/author\\\/pocholo-editor#author\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/author\\\/pocholo-editor\",\"name\":\"Pocholo Legaspi\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\",\"name\":\"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\",\"description\":\"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/author\\\/pocholo-editor#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/author\\\/pocholo-editor#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/main-1.webp\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\\\/#mainImage\",\"width\":1376,\"height\":768,\"caption\":\"Black server tower on a dark circuit-board background with glowing orange data cubes nearby.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/blogs\\\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#mainImage\"},\"datePublished\":\"2026-10-31T06:27:35+00:00\",\"dateModified\":\"2026-11-05T06:30:20+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/\",\"name\":\"Admin By Request\",\"alternateName\":\"ABR\",\"description\":\"Local Admin Rights, Managed.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.adminbyrequest.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor<\/title>\n\n","aioseo_head_json":{"title":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","description":"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.","canonical_url":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"aomei,backdoor,cybersecurity,pam,privileged access management","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#blogposting","name":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","headline":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","author":{"@id":"https:\/\/www.adminbyrequest.com\/en\/author\/pocholo-editor#author"},"publisher":{"@id":"https:\/\/www.adminbyrequest.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/main-1.webp","width":1376,"height":768,"caption":"Black server tower on a dark circuit-board background with glowing orange data cubes nearby."},"datePublished":"2026-10-31T06:27:35+00:00","dateModified":"2026-11-05T06:30:20+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage"},"isPartOf":{"@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage"},"articleSection":"Blogs, AOMEI, Backdoor, Cybersecurity, PAM, Privileged Access Management, Pocholo Legaspi, Paul Fisher"},{"@type":"BreadcrumbList","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/www.adminbyrequest.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/category\/blogs#listItem","name":"Blogs"}},{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/category\/blogs#listItem","position":2,"name":"Blogs","item":"https:\/\/www.adminbyrequest.com\/en\/category\/blogs","nextItem":{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#listItem","name":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#listItem","position":3,"name":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","previousItem":{"@type":"ListItem","@id":"https:\/\/www.adminbyrequest.com\/en\/category\/blogs#listItem","name":"Blogs"}}]},{"@type":"Organization","@id":"https:\/\/www.adminbyrequest.com\/en\/#organization","name":"Admin By Request","description":"Local Admin Rights, Managed.","url":"https:\/\/www.adminbyrequest.com\/en\/","telephone":"+12622994600","logo":{"@type":"ImageObject","url":"\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\/#organizationLogo"},"image":{"@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/adminbyrequest","https:\/\/twitter.com\/AdminByRequest","https:\/\/www.instagram.com\/AdminByRequest\/","https:\/\/www.tiktok.com\/@adminbyrequest","https:\/\/www.youtube.com\/channel\/UCwq1wlbT9m_z3YH-EPaZqKw","https:\/\/www.linkedin.com\/company\/adminbyrequest\/"]},{"@type":"Person","@id":"https:\/\/www.adminbyrequest.com\/en\/author\/pocholo-editor#author","url":"https:\/\/www.adminbyrequest.com\/en\/author\/pocholo-editor","name":"Pocholo Legaspi"},{"@type":"WebPage","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#webpage","url":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor","name":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","description":"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.adminbyrequest.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#breadcrumblist"},"author":{"@id":"https:\/\/www.adminbyrequest.com\/en\/author\/pocholo-editor#author"},"creator":{"@id":"https:\/\/www.adminbyrequest.com\/en\/author\/pocholo-editor#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/11\/main-1.webp","@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor\/#mainImage","width":1376,"height":768,"caption":"Black server tower on a dark circuit-board background with glowing orange data cubes nearby."},"primaryImageOfPage":{"@id":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor#mainImage"},"datePublished":"2026-10-31T06:27:35+00:00","dateModified":"2026-11-05T06:30:20+00:00"},{"@type":"WebSite","@id":"https:\/\/www.adminbyrequest.com\/en\/#website","url":"https:\/\/www.adminbyrequest.com\/en\/","name":"Admin By Request","alternateName":"ABR","description":"Local Admin Rights, Managed.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.adminbyrequest.com\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Admin By Request \u00bb Local Admin Rights, Managed.","og:type":"article","og:title":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","og:description":"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.","og:url":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor","og:image":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg","og:image:secure_url":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg","article:published_time":"2026-10-31T06:27:35+00:00","article:modified_time":"2026-11-05T06:30:20+00:00","article:publisher":"https:\/\/www.facebook.com\/adminbyrequest","twitter:card":"summary_large_image","twitter:site":"@AdminByRequest","twitter:title":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","twitter:description":"A supply chain attack on AOMEI Backupper used unsigned config files to deliver a backdoor. Confirmed victims include IT services, telecoms and universities.","twitter:creator":"@AdminByRequest","twitter:image":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2023\/05\/Circle-Tick-24.svg"},"aioseo_meta_data":{"post_id":"38269","title":"#post_title","description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-11-05 06:32:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-11-05 06:27:35","updated":"2026-11-05 06:45:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.adminbyrequest.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.adminbyrequest.com\/en\/category\/blogs\" title=\"Blogs\">Blogs<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tAttackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.adminbyrequest.com\/en\/"},{"label":"Blogs","link":"https:\/\/www.adminbyrequest.com\/en\/category\/blogs"},{"label":"Attackers Hijack AOMEI Backupper Update Servers to Deliver Backdoor","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/attackers-hijack-aomei-backupper-update-servers-to-deliver-backdoor"}],"authors":[{"term_id":428,"user_id":16,"is_guest":0,"slug":"pocholo-editor","display_name":"Pocholo Legaspi","avatar_url":{"url":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2025\/04\/Pocholo-Headshot.jpg","url2x":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2025\/04\/Pocholo-Headshot.jpg"},"avatar_alt":"","avatar_decorative":"","author_category":"1","user_url":"https:\/\/www.linkedin.com\/in\/pochololegaspi\/","last_name":"Legaspi","first_name":"Pocholo","job_title":"Content Writer","description":"Pocholo Legaspi is a content writer at Admin By Request, where he covers privileged access management, endpoint security, threat analysis, and the wider cybersecurity issues facing IT teams. With over a decade in content marketing and SEO and a master's in business informatics, he writes about complex security topics in a way that's clear and useful for the IT teams putting them into practice."},{"term_id":559,"user_id":20,"is_guest":0,"slug":"paul-fisher","display_name":"Paul Fisher","avatar_url":{"url":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/01\/Paul-w-Background.png","url2x":"https:\/\/www.adminbyrequest.com\/en\/wp-content\/uploads\/2026\/01\/Paul-w-Background.png"},"avatar_alt":"","avatar_decorative":"","author_category":"1","user_url":"","last_name":"Fisher","first_name":"Paul","job_title":"Head of Global Strategy","description":"Paul Fisher is Head of Global Strategy at Admin By Request and has written about enterprise IT since 1991, first as a journalist and editor, then as an analyst. As Lead Analyst for PAM and IAM at KuppingerCole, he wrote the firm\u2019s benchmark PAM market research and moderated the PAM track at the European Identity and Cloud Conference. He\u2019s a regular speaker at major identity and cybersecurity events, and he advises organizations on PAM, IAM, and security platform implementations."}],"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/posts\/38269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/comments?post=38269"}],"version-history":[{"count":1,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/posts\/38269\/revisions"}],"predecessor-version":[{"id":38271,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/posts\/38269\/revisions\/38271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/media\/38270"}],"wp:attachment":[{"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/media?parent=38269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/categories?post=38269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/tags?post=38269"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.adminbyrequest.com\/en\/wp-json\/wp\/v2\/ppma_author?post=38269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}