Attackers replaced files on AOMEI Backupper’s own update servers for five to ten minutes at a time between May and July 2026, Kai Tanner reports today (the correct download address was helpfully supplying the wrong file).

An administrator could fetch the backdoor from the expected server. A later check could find the legitimate file restored. The address and the subsequent inspection could both look right.

So a successful backup job leaves an awkward question unanswered: can the program entrusted with recovery itself be trusted?

Cheung Kwok-keung’s filing on the October 15 banking scam alert supplies the customer-facing version of that problem. A convincing login screen can solicit credentials. The alert says banks do not send transaction links by SMS or email. In Tanner’s story, even the genuine delivery channel had been compromised.

For a Hong Kong bank, the relevant supervisory home is HKMA’s Banking Supervision Department, including its operational and technology risk division. SPM TM-G-1 covers institution-wide technology risk and IT controls. SPM TM-G-2 covers recovery strategies and testing. The public scam alert changes no supervisory obligation.

Neither filing establishes that a Hong Kong bank used the affected software. The consequence is in what recovery evidence can establish: a completed job records an operation; it cannot, by itself, establish the integrity of the program performing it.

Under SPM OR-2, banks were required to be operationally resilient by May 31, 2026. That expectation is already in force, including when the recovery software reports success.