Attackers Hijacked AOMEI Backupper Updates to Deliver a Remote-Access Backdoor
Summary
GTIG reports attackers altered AOMEI’s update infrastructure to deliver a downloader and persistent backdoor. Three tampering windows were confirmed; further windows may have occurred. AnyViewer infections were not separately confirmed.
Key points
- Attackers compromised AOMEI Technology’s update and notification infrastructure, affecting AOMEI Backupper customers.
- They changed download instructions to point to a malicious ZIP and altered the expected version and MD5 checksum so the client would accept it.
- GTIG confirmed tampering windows of 10, 6, and 5 minutes between April and July; additional windows may have occurred.
- The downloader installed a persistent remote-access backdoor that can run commands and install more malware. Researchers did not identify the delivered malware as ransomware or an infostealer.
- The same system serves AnyViewer, but the report did not separately confirm infections among its customers.
- Suggested checks include looking for a scheduled task named RadminComponentRuntime, unexpected upgrade-now.exe or upgrade-now.zip files, and traffic to promotion[.]storage-data[.]com, aomei[.]storage-data[.]com, or storage-data[.]com.
- The article advises affected users to update security software and scan their PCs; it warns that the downloader may delete itself, so its absence does not establish that a system is clean.
Article Details
- Victim Organization
- AOMEI Technology
- Incident Type
- Compromise of AOMEI's update and notification infrastructure to distribute a malicious ZIP archive, initial downloader, and persistent remote-access backdoor.
- Operational Impact
- The researchers confirmed three software-tampering windows lasting ten, six, and five minutes. Customers who downloaded the malicious update could have malware installed; the backdoor could allow attackers to run commands and install additional malware. The number of affected devices is not reported.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aomei[.]storage-data[.]com | Listed as an indicator of outgoing traffic associated with the AOMEI update-infrastructure malware campaign. |
| DOMAIN | promotion[.]storage-data[.]com | Listed as an indicator of outgoing traffic associated with the AOMEI update-infrastructure malware campaign. |
| DOMAIN | storage-data[.]com | Listed as an indicator of outgoing traffic associated with the AOMEI update-infrastructure malware campaign. |
| IPV4 | 47[.]239[.]60[.]117 | Listed as an indicator of outgoing traffic associated with the AOMEI update-infrastructure malware campaign. |
| IPV4 | 8[.]210[.]84[.]56 | Listed as an indicator of outgoing traffic associated with the AOMEI update-infrastructure malware campaign. |
| IPV4 | 8[.]218[.]65[.]184 | Listed as an indicator of outgoing traffic associated with the campaign; the article also says Malwarebytes blocks this address. |
Vendors
AOMEI TechnologyThe Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July.MalwarebytesIf you used AOMEI Backupper during the affected period, update your security software and run a scan. You can download Malwarebytes Free to check for and remove malware.
Products
AnyViewerThe same system also serves AnyViewer customers, but the report does not separately identify confirmed AnyViewer infections.AOMEI BackupperAOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide. It lets users back up files, copy entire drives, and recover data if something goes wrong with their PC.