Attackers repeatedly tampered with AOMEI Backupper’s update servers between May and July 2026, modifying the update files for brief periods (5-10 minutes) to deliver a backdoor. Any Windows backup program checking for updates during these windows would download and execute the malicious payload. This supply chain attack, discovered by Google Threat Intelligence Group, Mandiant, and ManageEngine, demonstrates a sophisticated method of distributing malware through trusted channels.