AOMEI Backupper update servers hijacked to push malware: Check your PC

The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide. It lets users back up files, copy entire drives, and recover data if something goes wrong with their PC. The attackers briefly altered AOMEI’s update and notification infrastructure to make customers’ software download and run malware . The same system also serves AnyViewer customers, but the report does not separately identify confirmed AnyViewer infections. For brief periods, the attackers changed the software’s download instructions to point to a malicious ZIP archive. They also changed the expected version number and MD5 checksum so the client would accept it. Because the same remote configuration file provided the download address and expected checksum, the attackers could change both the download and the information the software used to accept it. The researchers confirmed three tampering windows lasting ten, six, and five minutes, but more may have occurred. While these short windows provided fewer opportunities to infect machines, they also made the attack harder to spot. The attack used an initial downloader to install a persistent remote-access backdoor . The researchers did not identify the delivered malware as ransomware or an infostealer, but the backdoor lets attackers run commands and install additional malware. That means an infected PC could remain open to further attacks. How to check if you were affected If you used AOMEI Backupper during the affected period, update your security software and run a scan. You can download Malwarebytes Free to check for and remove malware. Malwarebytes’ AI detection engine identifies the initial malware downloader, upgrade-now.exe , as Malware.AI.4006642887 so ThreatDown and Malwarebytes customers were protected by the real-time detection component. Malwarebytes detects the malware dropper upgrade-now.exe If you’re comfortable checking Windows settings and files, these are additional warning signs: Open Windows Task Scheduler and check the Task Scheduler Library for a task named RadminComponentRuntime . Look in your AOMEI Backupper installation folder, particularly its version-specific html and Tmphtml folders, for an unsigned upgrade-now.exe or an unexpected upgrade-now.zip . Note that the malware downloader deletes itself after staging the next payload and creating persistence, so its absence does not mean the PC is clean. If you’re seeing outgoing traffic to promotion.storage-data.com , aomei.storage-data.com , storage-data.com , 8.210.84.56 , 47.239.60.117 , or 8.218.65.184 , whether blocked or allowed. Malwarebytes blocks 8.218.65.184 If you encounter one of these signs, get help rather than trying to clean everything manually. Disconnect the PC from the internet if you suspect it is actively compromised, and contact a trusted computer technician, Malwarebytes Support , or your organization’s IT/security team. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today . About the author Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.