Newly disclosed on October 15–16, 2026. The activity researchers observed happened between April and July 2026.
Businesses usually trust software updates. In this case, attackers briefly changed the instructions that told a backup program where to get an update. A computer that checked at the wrong moment could download and run malware. Minutes later, the instructions looked normal again.
The software was AOMEI Backupper, a Windows backup program. Google Threat Intelligence Group and Mandiant reported the wider campaign on October 15. ManageEngine’s Threat Analysis Lab published its investigation on October 16.
What happened?
AOMEI Backupper asks AOMEI’s servers for small instruction files. Normally, those files point the program to genuine content. Researchers found that attackers changed them for short periods, then put the real instructions back.
Google confirmed three windows: May 28 for about 10 minutes, July 16 for about six minutes, and July 20 for about five minutes. It also found related malicious files from late April. A computer checking during a changed window could be sent to an attacker-controlled download. The program’s notification feature could then run the downloaded file.
That file could install a backdoor: software that lets an attacker keep access to a computer. Researchers tracked parts of the malware as CROSSROAD and SHINYROAD. AOMEI’s servers looked clean when checked outside the short windows. That made the attack hard to spot after the fact.
Who may be affected?
The clearest concern is for organizations that ran AOMEI Backupper on Windows during the April–July 2026 campaign. ManageEngine directly observed suspicious activity on two customer computers on May 28. Google also identified affected organizations across several countries and sectors, including IT services, telecoms, and education. Its wider investigation included AOMEI AnyViewer’s update and notification systems.
This does not mean every AOMEI user was infected. A computer would have needed to check for content during one of the short malicious windows, and the researchers do not know the full number of affected computers.
What is confirmed, and what remains unclear?
Researchers confirmed that AOMEI-hosted instructions were briefly altered and that malicious code ran on some computers. Google says it notified AOMEI on July 17, and AOMEI said on July 29 that it had taken corrective action on its servers.
The public reports do not establish how the attacker first gained control of those server instructions. They also do not give a final victim count. No AI role is claimed in this attack.
There is one lasting risk: fixing the vendor’s server does not remove malware already installed on a customer’s computer.
What should a business do now?
- Find affected software. Ask IT which Windows computers ran AOMEI Backupper or AnyViewer between April and July 2026.
- Check past alerts and logs. Look for AOMEI update or notification processes launching unfamiliar programs, especially around May 28, July 16, and July 20. Use the researchers’ technical findings for detailed signs.
- Investigate suspicious computers. If you find matching activity, isolate the device, remove the malware through your incident response process, and review whether accounts or data were accessed.
- Review update trust. For software your business builds or buys, ask whether downloaded programs and update instructions are independently signed and checked before they run.
The wider lesson is simple: a clean download page today cannot prove that an update was safe yesterday. Logs from the computer that received the update matter.
For businesses reviewing how they detect and respond to threats on their systems, see AZAS Technologies’ cybersecurity services.
Sources and dates
- Google Threat Intelligence Group and Mandiant, “Investigating Ephemeral Supply Chain Tampering,” October 15, 2026. Primary source for the April–July campaign, confirmed tampering windows, affected sectors, and response guidance.
- ManageEngine Threat Analysis Lab, “AOMEI Backupper supply-chain compromise,” October 16, 2026. Primary source for the May 28 endpoint detections and the update mechanism.
AZAS Technologies did not investigate this incident.
