Ten minutes. That’s how long one of the windows lasted.

Between May and July 2026, attackers repeatedly changed the files AOMEI Backupper fetches from the vendor’s own update servers. Each change lasted 5 to 10 minutes. Any copy of the Windows backup program that checked for an update inside one of those windows downloaded and ran a backdoor. The Hacker News has the full timeline.

Then the clean files went back. A machine that checked in a minute later got the genuine update. So did anyone who went to look.

If your clients run backup software that updates itself, read on.

How a 10-minute window works

AOMEI Backupper runs background services that check the vendor’s servers over HTTPS for updates and promotional pop-ups. Two small text files drive that check. One names the update package and the checksum the program uses to verify it. The other tells the pop-up service what to show and what to run.

According to the report, the program does not cryptographically verify either file. The checksum that is supposed to prove the download is genuine sits inside the same unsigned file that names it.

Nothing was exploited. No vulnerability, no click from the user. The attacker changed 2 text files on the server for a few minutes, and the software did the rest.

Researchers confirmed 3 windows: 10 minutes on May 28, 6 minutes on July 16 and 5 minutes on July 20. They say there were likely more. Affected organizations sat in IT services, telecommunications and higher education across 11 countries, including the United States, Australia and Spain.

Why file scanners missed it

Think about how most checks work. A tool looks at a file at a point in time and decides whether it is bad.

Here, the bad file existed for minutes. Before and after, the server served genuine content. The researchers said the short windows effectively got past point-in-time triage and automated file scanning.

It gets worse on the machine. The downloader set up a scheduled task, then put the local update file back to its genuine contents and deleted itself. The backdoor loads through a genuine, signed remote-administration program sitting beside an attacker-built file. An infected machine looks normal, and the vendor’s download page looks clean.

The report warns that analysts have dismissed real detections as false alarms because they checked the download page afterwards and found nothing wrong. That’s the trap. File-based checks were looking in the wrong place at the wrong time.

The network was the clean signal

Files changed back. The traffic didn’t.

New destinations. The backdoor talks to a single hard-coded address with no backup. The report names the attacker’s domains and IP addresses, and blocking that one address cuts off control. A backup program, or anything it launched, opening a connection to somewhere it has never talked to before is the signal that survives the file going back.

Outbound SMB or WebDAV. The July 20 window carried a second trick that needed no program to run at all. The pop-up file was changed to open an invisible one-pixel window pointing at a file on the attacker’s server over WebDAV. Rendering it makes Windows send the user’s NetNTLMv2 authentication response to the attacker, a token they then try to crack offline or reuse. The machine stays clean. The credential walks out.

Neither of those shows up in a file scan. Both show up in network data.

What to do this week

1. List every client machine running AOMEI Backupper or AnyViewer, which the report says uses the same update flow.

2. Hunt back to April. Look for scheduled tasks named RadminComponentRuntime or NitroRuntime, an unsigned upgrade-now.exe carrying AOMEI’s publisher details and any program running from Backupper’s html pop-up folder.

3. Block the attacker infrastructure named in the report: storage-data[.]com, promotion.storage-data[.]com, aomei.storage-data[.]com, 8.210.84[.]56, 8.218.65[.]184 and 47.239.60[.]117.

4. Block outbound SMB (TCP 445) and WebDAV to external addresses at every client firewall.

5. Don’t judge an alert by checking the vendor’s site now. Keep the files cached in the program’s own folders, and check network logs for what was served at the exact time the alert fired.

Steps 3 and 4 are firewall changes. Step 1 is an inventory. Step 2 takes longest, because the period runs from April to July and the downloader cleaned up after itself.

A fixed server doesn’t clean a machine that was already hit. The report is clear on that.

The outcome: the traffic gives it away

Do this and the 10-minute window stops mattering. You don’t need to catch the file in the moment it exists. You need to see the connection it makes afterwards, and you need outbound SMB and WebDAV to go nowhere.

That changes the question you ask. Not “was this file bad?” but “why is the backup software talking to an address it has never used?” The second question has an answer in your network logs long after the file has gone back.

My advice would be to start with the firewall rules today. They take minutes, and they close the credential trick across every client at once.

At enhanced.io, our Expert-led SOC watches network traffic across the whole MSP estate, so a new destination or an outbound SMB session gets detected and escalated to your team.

Key takeaways

• Attackers changed AOMEI Backupper update files on the vendor’s own servers for 5 to 10 minutes at a time between May and July 2026.

• Only copies that checked in during a window got the backdoor, and the files went back to genuine contents afterwards.

• Point-in-time checks and file scanning had little to catch, and checking the vendor’s site later shows clean files.

• The clean signal is network traffic: new external destinations and outbound SMB or WebDAV.

• Block the named infrastructure and outbound SMB and WebDAV, then hunt back to April.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.