AOMEI Backupper Update Servers Hijacked to Push Malware Check Your PC
AOMEI Backupper Update Servers Hijacked to Push Malware: Check Your PC 🚨
The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide.
The attackers briefly altered AOMEI’s update and notification infrastructure to make customers’ software download and run malware. For brief periods, the attackers changed the software’s download instructions to point to a malicious ZIP archive. They also changed the expected version number and MD5 checksum so the client would accept it. Because the same remote configuration file provided the download address and expected checksum, the attackers could change both the download and the information the software used to accept it.
The researchers confirmed three tampering windows lasting ten, six, and five minutes, but more may have occurred. While these short windows provided fewer opportunities to infect machines, they also made the attack harder to spot. The attack used an initial downloader to install a persistent remote-access backdoor. The researchers did not identify the delivered malware as ransomware or an infostealer, but the backdoor lets attackers run commands and install additional malware. That means an infected PC could remain open to further attacks. The same system also serves AnyViewer customers, but the report does not separately identify confirmed AnyViewer infections.
If you used AOMEI Backupper during the affected period, update your security software and run a scan. The initial malware downloader, upgrade-now.exe, is identified as Malware.AI.4006642887. If you’re comfortable checking Windows settings and files, these are additional warning signs:
- Open Windows Task Scheduler and check the Task Scheduler Library for a task named
RadminComponentRuntime. - Look in your AOMEI Backupper installation folder, particularly its version-specific
htmlandTmphtmlfolders, for an unsignedupgrade-now.exeor an unexpectedupgrade-now.zip.
Note that the malware downloader deletes itself after staging the next payload and creating persistence, so its absence does not mean the PC is clean.