AOMEI Backupper update servers hijacked to deliver a backdoor
Original title: AOMEI Backupper update servers hijacked to push malware: Check your PC
Google’s threat intel group confirmed three tampering windows of ten, six, and five minutes between April and July.
The Google Threat Intelligence Group says attackers compromised AOMEI Technology’s update and notification infrastructure and briefly redirected AOMEI Backupper clients to a malicious ZIP. They changed the expected version and MD5 checksum in the same remote configuration so the client would accept the file. An initial downloader, upgrade-now.exe, installed a persistent remote-access backdoor that can run commands and add more malware. The same system serves AnyViewer, but the report does not confirm AnyViewer infections. AOMEI says Backupper is used by more than 100 million people.
Unconfirmed: Researchers say more tampering windows may have occurred, and they did not classify the final payload as ransomware or an infostealer.
- Confirmed tampering windows lasted ten, six, and five minutes; more may have occurred.
- Look for a scheduled task named RadminComponentRuntime.
- Malwarebytes labels the downloader Malware.AI.4006642887.
- The downloader deletes itself after staging the next payload.
- Named hosts include promotion.storage-data.com, aomei.storage-data.com, and storage-data.com.
Impact: Persistent backdoor can run commands and install further malware
| Product | Affected |
|---|---|
| AOMEI Technology AOMEI Backupper | — |
- 1.Scan PCs that used AOMEI Backupper during the April–July period.
- 2.Check Task Scheduler for a task named RadminComponentRuntime.
- 3.Look for unsigned upgrade-now.exe or unexpected upgrade-now.zip in the Backupper install folders.
- Vendors
- AOMEI Technology
- Products
- AOMEI BackupperAnyViewer
- Malware
- upgrade-now.exe
- Organizations
- Google Threat Intelligence Group
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 47.239.60.117 | , aomei.storage-data.com , storage-data.com , 8.210.84.56 , 47.239.60.117 , or 8.218.65.184 , whether blocked or allowed. Malwarebyte |
| ipv4 | 8.210.84.56 | rage-data.com , aomei.storage-data.com , storage-data.com , 8.210.84.56 , 47.239.60.117 , or 8.218.65.184 , whether blocked or allo |
| ipv4 | 8.218.65.184 | a.com , storage-data.com , 8.210.84.56 , 47.239.60.117 , or 8.218.65.184 , whether blocked or allowed. Malwarebytes blocks 8.218.65. |
From the original article
2 min read at malwarebytes.com
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.