ATTACKERS compromised AOMEI Technology’s update and notification infrastructure between April and July 2026, according to Google Threat Intelligence Group reports cited by Malwarebytes. The intruders briefly altered the update system used by AOMEI Backupper (and also serving AnyViewer customers) so that legitimate software would download and execute a malicious ZIP archive.
They also manipulated the expected version numbers and MD5 checksums, enabling the malicious package to be accepted by the client because the same remote configuration file supplied both the download location and the checksum.
Researchers observed three tampering windows lasting ten, six and five minutes, each giving a narrow window for infection. The attack deployed a persistent remote-access backdoor via an initial downloader, described by Malwarebytes as Malware[.]AI.4006642887, with the backdoor enabling command execution and deployment of additional payloads. While the May infection wasn’t classified as ransomware or an infostealer in the report, the backdoor provided ongoing access for attackers to expand their foothold.
The impact could extend beyond initial machines, depending on whether attackers executed subsequent payloads or pivoted within affected networks.
How to check and respond, per the article, includes updating security software and running a scan if you used AOMEI Backupper during the affected period.
Indicators to watch include an unsigned upgrade-now[.]exe or unexpected upgrade-now[.]zip in the installation folder, unusual entries in Windows Task Scheduler (notably a task named RadminComponentRuntime), and outbound traffic to domains and IPs such as promotion.storage-data[.]com, aomei.storage-data[.]com, storage-data[.]com, 8.210.84[.]56, 47.239.60[.]117, or 8.218.65[.]184. If signs appear, disconnect from the internet and seek assistance from a trusted technician or Malwarebytes Support.