Threats Tagged 'upgrade-now.exe'

Between April and July 2026, attackers compromised the update and notification infrastructure of AOMEI Technology to distribute malware to users of AOMEI Backupper, a widely used backup software. The attackers hijacked the update servers during three brief windows, modifying download instructions to deliver a malicious ZIP archive containing a downloader that installed a persistent remote-access backdoor. This backdoor allows attackers to execute commands and install additional malware, increasing the risk of further system compromise. The compromised infrastructure also serves AnyViewer customers. Detection was difficult due to the short tampering periods. Users can check for infection by scanning with security software, inspecting Task Scheduler for specific tasks, searching for unsigned upgrade-now.exe files, or monitoring suspicious network traffic to certain domains.