Attackers Hijacked AOMEI Backupper Servers to Distribute Remote Access Malware
Compromised update infrastructure pushed a backdoor to users during brief windows in April through July, requiring manual checks for infection.
Key points
- Attackers altered AOMEI Backupper update servers to deliver a persistent remote-access backdoor.
- The campaign targeted users between April and July, with confirmed tampering lasting minutes at a time.
- Users should scan for specific file artifacts and monitor for suspicious outbound network traffic.
Attackers compromised the update and notification infrastructure of AOMEI Technology to distribute malware to users of its backup software, according to research published by Malwarebytes Labs citing Google Threat Intelligence Group findings. The campaign occurred between April and July 2026, during which threat actors briefly hijacked the system to push malicious payloads.
The attackers modified the remote configuration files that AOMEI Backupper clients use to verify software updates. By changing the download address and the expected MD5 checksum simultaneously, the malware bypassed the client’s integrity checks. This allowed the software to accept a malicious ZIP archive as a legitimate update, installing a downloader that established a persistent remote-access backdoor on infected systems.
Technical Details of the Compromise
Researchers identified three specific tampering windows lasting ten, six, and five minutes respectively, though additional incidents may have occurred. These short durations limited the number of infections but also made the attack difficult to detect automatically. The initial downloader, named upgrade-now.exe, installed a backdoor that allows attackers to run commands and deploy additional malware, though it was not identified as ransomware or an infostealer.
Malwarebytes’ AI detection engine classifies the initial downloader as Malware.AI.4006642887. While real-time protection caught the threat for some users, the backdoor’s persistence mechanisms mean infected machines remain vulnerable to further exploitation. The system also serves AnyViewer customers, but the report does not confirm separate infections for that product.
Who Is Affected
AOMEI Backupper is backup software used by more than 100 million people worldwide to copy drives and recover data. Any user who ran the software during the affected period between April and July is potentially at risk. The attack targeted the update mechanism itself, meaning users who trusted the official update channel were exposed to the malicious payload without obvious warning signs during the brief compromise windows.
What should you do?
Users should update their security software and run a full system scan immediately. Malwarebytes Free can be used to check for and remove the malware. For those comfortable inspecting system files, check the Windows Task Scheduler for a task named RadminComponentRuntime. Additionally, inspect the AOMEI Backupper installation folder, specifically the html and Tmphtml subdirectories, for an unsigned upgrade-now.exe or an unexpected upgrade-now.zip file.
Note that the malware downloader deletes itself after staging the next payload and creating persistence, so the absence of the file does not guarantee the system is clean. Monitor for outgoing traffic to promotion.storage-data.com, aomei.storage-data.com, storage-data.com, or the IP addresses 8.210.84.56, 47.239.60.117, and 8.218.65.184. If any of these signs are present, disconnect the PC from the internet and contact a trusted technician or IT security team.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: AOMEI Backupper
- Run a full system scan using updated antivirus or anti-malware software to detect the specific backdoor and downloader.
- Inspect Windows Task Scheduler for the suspicious task named RadminComponentRuntime and remove it if found.
- Check the AOMEI Backupper installation directory for unsigned executable files named upgrade-now.exe or unexpected zip archives.
- Monitor network logs for outbound connections to the specific domains and IP addresses associated with the command-and-control infrastructure.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What malware was delivered via the compromised AOMEI Backupper updates?
The attack delivered an initial downloader that installed a persistent remote-access backdoor, allowing attackers to run commands and install additional malware.
How long did the attackers have access to the update servers?
Researchers confirmed three tampering windows lasting ten, six, and five minutes, though more incidents may have occurred during the April to July period.
Is AnyViewer also affected by this compromise?
The compromised system also serves AnyViewer customers, but the report does not separately identify confirmed AnyViewer infections.
