AOMEI Backupper update servers hijacked to push malware: Check your PC

Attackers compromised AOMEI Technology's update and notification infrastructure between April and July 2026, targeting AOMEI Backupper users. During three short tampering windows (10, 6, and 5 minutes), they altered download instructions to deliver a malicious ZIP archive with an initial downloader that installed a persistent remote-access backdoor. This backdoor enables remote command execution and installation of additional malware. The same compromised infrastructure also serves AnyViewer customers. The brief duration of tampering limited infection opportunities and detection. Indicators include suspicious domains such as storage-data.com and unsigned upgrade-now.exe files. Infection can be detected by scanning with security tools, checking Task Scheduler for RadminComponentRuntime tasks, and monitoring network traffic to identified domains and IPs.

The compromise allowed attackers to distribute a remote-access backdoor to users of AOMEI Backupper, potentially enabling unauthorized command execution and further malware installation on infected systems. This increases the risk of persistent system compromise and data exposure. The brief tampering windows limited the scale of infections, but affected users remain vulnerable if infected. The supply chain nature of the attack undermines trust in the update mechanism of the software.

No official patch or remediation is indicated in the provided data. Users should scan their systems with updated security software to detect and remove the backdoor. Additionally, users should examine Task Scheduler for suspicious tasks named RadminComponentRuntime, search for unsigned upgrade-now.exe files, and monitor network traffic for connections to domains such as storage-data.com, promotion.storage-data.com, and aomei.storage-data.com. Applying these detection and removal steps is recommended to mitigate infection risks.