Insights Security & Privacy
AOMEI Backupper update servers hijacked to spread malware: check your PC
The short version
Between April and July 2026, attackers briefly altered AOMEI's update servers so that Backupper, a Windows backup tool, downloaded and ran malware. AOMEI says its servers are now secure, but that does not clean a PC that was already infected.
What happened
The attackers changed two settings files on AOMEI's servers for only a few minutes at a time, then put them back. Researchers confirmed three such windows, lasting ten, six and five minutes, though more may have gone unseen. A PC that checked for updates during one of those minutes was sent a fake update, which ran without the user clicking anything.
The fake update installed a downloader and then a backdoor, which lets attackers run commands and add more malware. Google and ManageEngine's threat analysis lab uncovered the campaign. AOMEI says it has upgraded its servers, and its chief technology officer is investigating.
Why it matters to you
Because the changes lasted minutes, a PC could be infected without any sign, and the original malicious files may no longer be on the servers to find. On July 20 the attackers also tried to capture Windows login data (password hashes), and an infected PC stays open to later attacks.
The software is described as having over 100 million users, and the attack hit whoever checked at the wrong moment. Even a backup PC holding important files could be affected.
What to do
If you used AOMEI Backupper between April and July, update your security software and run a scan. In Windows Task Scheduler, look for a task named RadminComponentRuntime. If you find it, disconnect the PC from the internet and ask a trusted technician for help rather than cleaning it yourself.
An absent upgrade-now.exe file does not mean the PC is clean, because the malware deletes itself.
Sources
- Investigating Ephemeral Supply Chain Tampering Google Cloud Threat Intelligence blog (opens in a new tab)
- Hackers hijack AOMEI update servers to secretly spread malware BleepingComputer (opens in a new tab)
- AOMEI Backupper update servers hijacked to push malware: Check your PC Malwarebytes (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.