A successful backup job cannot establish the integrity of the program running it.

Attackers repeatedly replaced files fetched by AOMEI Backupper from the vendor’s own update servers between May and July 2026. Each substitution lasted five to ten minutes. The download came from the expected address. The file available later could be the expected file too.

An administrator checking both could miss the delivery entirely.

The vendor address is supposed to help establish where an update came from. Here, attackers used that address to deliver a backdoor. The administrator could reach the correct destination and receive the attacker’s file.

That matters particularly in backup software. A recovery process depends on the program reading and restoring the saved data. A completed job establishes that the operation ran; it leaves the integrity of that program unanswered.

Elsewhere, attackers are exploiting CVE-2026-110447, a command execution flaw in Nextcloud’s Collabora Online built-in CODE Server app, to backdoor Nextcloud servers. Restoring a compromised server puts the backup program in a position of considerable trust. The AOMEI incident gives that trust its own verification problem.

An update signature checked against a separately protected signing key would make control of the download server alone insufficient to substitute executable code. Whether that check protected the affected downloads is not established here.

The brief substitutions also determine where useful evidence must survive: in records of the earlier download or on the machine that received it. A clean inspection of the update server later cannot settle what the administrator’s machine downloaded earlier.