3 Tampering Windows: Malwarebytes Identifies AOMEI Backdoor Push via Compromised Updates
Compromised update infrastructure pushed malware to AOMEI Backupper users during brief tampering windows in April through July.
Key points
- Attackers altered update instructions to deliver a persistent remote-access backdoor.
- Three confirmed tampering windows lasted five to ten minutes each.
- Malwarebytes Labs identified the threat via analysis of the compromised update chain.
Attackers compromised the update and notification infrastructure for AOMEI Backupper, a backup application used by more than one hundred million people globally. According to Malwarebytes Labs, the breach occurred during a campaign investigated between April and July. The attackers altered the software’s download instructions to distribute malware capable of granting remote access to infected computers. This supply-chain attack bypassed normal user expectations by leveraging the trusted update mechanism.
How did the attackers bypass security checks?
The attackers modified the remote configuration file that AOMEI Backupper clients use to verify updates. By changing both the download address and the expected MD5 checksum within the same file, they tricked the software into accepting a malicious ZIP archive. This allowed the client to download and execute the payload without raising standard integrity alerts. The same infrastructure serves AnyViewer customers, though the report does not confirm infections in that user base.
What was the scope and timing of the compromise?
Researchers confirmed three distinct tampering windows lasting ten, six, and five minutes respectively. Malwarebytes Labs noted that additional windows may have occurred but were not identified. These short durations limited the number of machines infected but also made the activity harder to detect in real time. The brief nature of the attack required precise timing to distribute the malicious payload before the infrastructure was restored or noticed.
What malware was delivered to victims?
The initial payload was a downloader named upgrade-now.exe, which installed a persistent remote-access backdoor. Malwarebytes Labs identified this file as Malware.AI.4006642887. The backdoor allows attackers to run commands and install additional malware, though it was not identified as ransomware or an infostealer. Because the downloader deletes itself after staging the next payload, its absence does not indicate a clean system. Persistence was established via a Windows Task Scheduler entry named RadminComponentRuntime.
What should teams do next?
Users who ran AOMEI Backupper during the affected period should update their security software and perform a full system scan. Malwarebytes Free can detect and remove the identified malware. Organizations should check for the specific task scheduler entry and monitor for outbound traffic to domains such as promotion.storage-data.com or IPs including 8.210.84.56. If signs of infection are found, disconnect the machine from the network and contact IT support or a trusted technician for remediation.
Detection notes
Teams usually identify this type of supply-chain compromise by monitoring for unexpected changes in update checksums or download URLs in application logs. Check whether endpoints are communicating with newly observed domains or IP addresses associated with the vendor’s infrastructure. Look for scheduled tasks created around the time of the suspected update window.
Verify that application binaries match known good hashes. Containment typically involves isolating affected hosts from the network to prevent lateral movement. Review firewall logs for outbound connections to suspicious storage domains. Ensure endpoint detection tools are updated to catch the specific downloader variants before they establish persistence.
Background: Infostealers
Infostealers operate in three phases: delivery via deceptive downloads, silent extraction of browser data and credentials, and exfiltration to attacker servers. You can stop them by isolating infected machines immediately and rotating all passwords and session tokens before they are compromised.
Read the full guide: How Infostealers Work: The Silent Theft of Your Digital Life
What to do and how to stay safe: AOMEI Backupper
- Run a full system scan using updated antivirus or anti-malware software to detect the downloader.
- Check Windows Task Scheduler for a task named RadminComponentRuntime and disable it if found.
- Monitor network logs for outbound traffic to promotion.storage-data.com or the listed IP addresses.
- Update AOMEI Backupper to the latest version once the vendor provides a clean update.
Step-by-step guide: Lateral Movement Prevention Checklist for Network Security
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did attackers compromise AnyViewer as well?
The same infrastructure serves AnyViewer customers, but the report does not separately identify confirmed infections for that software.
How long were the update servers compromised?
Researchers confirmed three tampering windows lasting ten, six, and five minutes, though more may have occurred.
Is the malware ransomware?
No, the delivered malware is a remote-access backdoor, not ransomware or an infostealer, but it allows further attacks.
