AOMEI Backuffer Update Supply Chain Breach Enables Remote Access

Attackers gained remote access to user computers by compromising the update mechanism of AOMEI Backupper. According to Malwarebytes Labs, the threat actors altered the software’s download instructions to point to malicious archives. This allowed them to bypass standard verification checks by simultaneously changing the expected version numbers and checksums. The breach provided attackers with command execution capabilities and the ability to install additional malware on infected machines.

How it unfolded

• Between April and July, researchers investigated a campaign targeting AOMEI Technology’s update and notification infrastructure.
• Attackers briefly altered download instructions three times, creating tampering windows lasting ten, six, and five minutes.
• The modified configurations directed clients to download a ZIP archive containing an initial malware downloader.

Who is affected

AOMEI Backupper is backup software used by more than 100 million people worldwide, according to the company. The same update system serves AnyViewer customers, though the report does not separately identify confirmed infections for that product. Users who ran AOMEI Backupper during the affected period are potentially at risk. The malware downloader, identified as Malware.AI.4006642887, deletes itself after staging the next payload, making detection difficult without specific checks.

The fix

Malwarebytes advises users to update their security software and run a full system scan. Professionals recommend downloading Malwarebytes Free to check for and remove the malware. Users can also manually inspect Windows Task Scheduler for a task named RadminComponentRuntime. Checking the AOMEI installation folder for unsigned upgrade-now.exe files or unexpected ZIP archives is also recommended. If active compromise is suspected, disconnect the PC from the internet and contact IT support.

What made it possible

Teams usually face challenges when a single configuration file controls both download sources and integrity checks. In this event, the weakness relied on the software trusting remote instructions for versioning and checksums without independent validation. Attackers exploited this dependency to substitute legitimate updates with malicious payloads. This technique serves the initial access and persistence stages of an intrusion. Organizations should check whether their software validates updates using separate, immutable channels to prevent similar supply chain tampering.

What to do and how to stay safe: AOMEI Backupper

• Scan endpoints with updated security tools to detect the specific malware downloader identified by researchers.
• Monitor network traffic for connections to domains such as promotion.storage-data.com or associated IP addresses.
• Inspect Windows Task Scheduler for the presence of the RadminComponentRuntime task on affected machines.
• Review application installation directories for unsigned executables or unexpected archive files that may indicate tampering.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers use ransomware in this campaign?

No, researchers did not identify the delivered malware as ransomware or an infostealer, but noted it allows remote command execution.

How long were the update servers compromised?

Researchers confirmed three tampering windows lasting ten, six, and five minutes, though more may have occurred.

Is there a patch for AOMEI Backupper?

The source material does not mention a vendor patch or update to fix the vulnerability in the update infrastructure.