AOMEI Backupper malware pushed from hijacked update servers

Attackers briefly hijacked AOMEI Backupper’s update and notification infrastructure so the program would download and execute malware, according to Malwarebytes and reporting at BleepingComputer. The changes happened in short windows between April and July 2026, and researchers say the malicious downloads were accepted by the client because the configuration files were altered to match the malicious files.

AOMEI Backupper malware: how the update servers were abused

Researchers found the attackers modified the remote configuration files the software uses to decide where to download updates and what checksum to expect. Malwarebytes says the altered files told the client to download a malicious ZIP and also changed the expected version number and MD5 checksum so the client would accept it. BleepingComputer reports that the specific configuration files modified included the update pointer and notification file, and that the attack used the notification mechanism to execute content without user interaction.

The initial payload was an installer or downloader called upgrade-now.exe that staged a persistent remote-access backdoor. Malwarebytes reports its AI engine identifies that initial downloader as Malware.AI.4006642887. According to BleepingComputer summarizing work by ManageEngine, Google’s Threat Intelligence Group, and Mandiant, the activity is associated with a tracked actor and involved a downloader named CROSSROAD and a backdoor named SHINYROAD.

Malwarebytes and the other researchers confirmed three brief tampering windows lasting ten, six, and five minutes. Those short windows reduce the chance to infect many machines, but they also make the changes harder to notice and harder to reproduce in testing, the reports note.

Who was affected and how opportunistic the campaign was

BleepingComputer says researchers identified affected organizations across several countries and sectors, and that Google warned the campaign appeared opportunistic: any machine that checked AOMEI’s update files during a tampering window could have received the malicious archive. Malwarebytes notes AOMEI Backupper is software the vendor says is used by more than 100 million people worldwide, which is why a supply chain vector on its update channel is significant.

Researchers first noticed unusual behavior on May 28 when a promotion or notification process launched a legitimate remote administration tool unexpectedly, which led to deeper monitoring and later captures of the malicious configurations on July 16, BleepingComputer reports.

What to check now

If you or your team used AOMEI Backupper during the April to July window, consider these steps. If you do not feel comfortable performing them yourself, get help from your IT or security provider.

• Update your antivirus and run a full scan with current definitions. Malwarebytes recommends running its scanner or another up-to-date product.
• Check Windows Task Scheduler for a task named RadminComponentRuntime, which Malwarebytes lists as a warning sign.
• Inspect the AOMEI Backupper installation folder, especially version-specific html and Tmphtml folders, for an unsigned upgrade-now.exe or an unexpected upgrade-now.zip. Note that the initial downloader may delete itself after staging, so absence is not proof of cleanliness.
• Watch for outbound connections to these domains and IPs: promotion.storage-data.com, aomei.storage-data.com, storage-data.com, 8.210.84.56, 47.239.60.117, and 8.218.65.184. Malwarebytes notes one of those IPs was blocked by their product.
• If you see signs of active compromise, disconnect the PC from the internet and get professional help rather than attempting advanced cleanup alone.
• Review and test your backups and recovery procedures to ensure you can restore clean systems if needed.
• If you host a site or want to understand what an attacker can learn from your web presence, start here: Scammers often start with your website. See what an attacker can already learn about yours.

Why this matters to small organizations and nonprofits

Backup and update channels are trusted by users and often run with elevated rights, which makes them attractive to attackers who can use a brief server-side change to reach many endpoints. Short tampering windows also mean automated defenses and routine checks can miss the activity. If you rely on a third-party utility for backups, a compromise in that software’s update or promotion systems can expose you even if your own network controls appear correct.

Practical next steps for administrators

• Notify your IT or security team about any use of AOMEI Backupper during the affected period and share the indicators above.
• Monitor logs for the listed domains and IPs, and consider blocking outbound traffic to those addresses until you have confirmed no infections.
• Prioritize scanning systems with updated definitions and validate backup integrity on clean media.
• If you find an infection or persistence mechanism, engage a trusted technician or incident responder rather than attempting deep removal on a production system.

Supply chain attacks like this are a reminder to treat update and notification channels as part of your threat model. The practical checks above follow the public reports; if you find concerning signs, get professional support and isolate affected machines until they are confirmed clean.