Google Threat Intelligence Group, Mandiant and ManageEngine's Threat Analysis Lab disclosed an operation in which attackers repeatedly altered the update files served by AOMEI Backupper — the Windows backup and disk-cloning tool made by Hong Kong-registered AOMEI Technology — in windows of five to ten minutes at a time between May and July 2026, so that any installation checking for an update during a window would download and run a backdoor. The check depends on two files, down_html.ini, which names the update package and the checksum used to verify it, and Notifycfg.ini, which tells the pop-up service what to display and run. The program does not cryptographically verify either file, and the checksum that is supposed to prove the download is genuine sits inside the same unsigned file that names it. AOMEI has reported fixing its servers, but that does not remove the backdoor from machines already infected. The campaign is a compact illustration of update-channel trust: short, targeted windows plus unsigned manifest files defeat any assumption that a vendor update check is inherently safe.

• Source article