Malware · Application Security
AOMEI Backupper update servers hijacked to deliver malware
Attackers briefly took control of AOMEI Backupper’s update servers, pushing malware to users in a stealthy supply chain attack. The company is investigating and has taken corrective action.
Ross GrantUpdated 3 min read
The short version
Attackers took control of the update servers for AOMEI Backupper, a popular backup program, for a few minutes at a time. During those moments, anyone updating the software could have downloaded malware instead of a real update. The malware gave attackers remote access to infected computers. The company is still investigating how the attackers got in.
By the numbers
- 100 million+AOMEI Backupper users worldwide (claimed by the company)Malwarebytes
- 3Confirmed attack windows (5–10 minutes each)Help Net Security
- 11+Countries with confirmed victimsHelp Net Security
What happened?
Attackers briefly hijacked the update servers for AOMEI Backupper, a widely used backup tool, between April and July 2026. During short windows, they pushed malware to users by altering update instructions. The company is investigating and has taken corrective action, but the exact method of compromise is not yet public.
Who is affected
The attack targeted users of AOMEI Backupper, a backup software reportedly used by over 100 million people worldwide. Confirmed victims include organisations in IT services, telecommunications and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States, according to Help Net Security (opens in a new tab). The attack was opportunistic: any system checking for updates during the brief attack windows could have been infected. AOMEI AnyViewer, which uses the same update mechanism, may also have been targeted, but confirmed infections are not detailed.
How the attack worked
Between April and July 2026, attackers gained access to AOMEI’s update and notification infrastructure. For three confirmed periods lasting five to ten minutes each, they altered configuration files on AOMEI’s servers. This caused the software’s update mechanism to download a malicious ZIP file from attacker-controlled servers instead of legitimate updates. The attackers also changed the expected version number and checksum, so the software would accept the malicious file as genuine. The attack was hard to detect because the tampering windows were so short.
The malicious update delivered a downloader, which installed a persistent remote-access backdoor. On affected systems, the malware installed Radmin (a legitimate remote administration tool) and a backdoor called SHINYROAD, then set up a scheduled task to maintain persistence. In some cases, the attackers also used the notification system to try to steal password hashes, even if the malware itself was blocked.
The dropper avoided infecting machines in China or those running certain security products. It deleted itself after installation to cover its tracks.
The response
ManageEngine’s Threat Analysis Lab first detected the attack on May 28, after logging suspicious activity on two unrelated customer machines. They notified AOMEI on June 7. Mandiant and Google Threat Intelligence Group (GTIG) later confirmed further tampering windows in July. AOMEI initially suggested the content was tampered with in transit, but researchers showed the compromise happened within AOMEI’s own delivery infrastructure. The company has since classified the incident as high priority, with its CTO leading the investigation, and said it has taken corrective action. Details of how the attackers gained access to the servers have not been disclosed.
What you should do
If you used AOMEI Backupper or AnyViewer between April and July 2026, update your security software and run a full scan. Malwarebytes and other vendors have published indicators of compromise, such as the presence of a scheduled task named RadminComponentRuntime or unusual files in the AOMEI installation folder. If you suspect compromise, disconnect from the internet and seek professional help. Organisations should review logs for connections to known malicious addresses and consider a deeper incident response if affected.
Malwarebytes (opens in a new tab) and Help Net Security (opens in a new tab) have published detailed guidance for checking and cleaning affected systems.
Why it matters
This attack shows how even trusted software updates can be used to spread malware if attackers compromise the delivery system. Supply chain attacks like this can affect many users at once and are hard to detect when the attack window is short.
Key points
- Attackers hijacked AOMEI Backupper update servers for short periods.
- Malware was delivered to users via the official update mechanism.
- The attack used a backdoor and remote administration tool for persistence.
- Victims span multiple sectors and countries, but the total number is unknown.
- AOMEI is investigating and has taken corrective action.
Sources
Malwarebytes
Reference
Help Net Security
Reference
