AOMEI Backupper Update Attack Installed a Windows Backdoor

AOMEI Backupper’s update system was tampered with several times between May and July 2026, causing some Windows computers to download and run a backdoor. AOMEI has reportedly secured its servers, but that does not remove malware from computers that were infected, according to The Hacker News.

What happened

Attackers briefly replaced files used by AOMEI Backupper to check for updates and promotional notices. Each known tampering period lasted only five to 10 minutes, so a computer was exposed only if Backupper contacted the servers during one of those short windows.

No software vulnerability or click from the user was required. The altered instructions caused Backupper to download and launch the attacker’s package with the privileges available to the AOMEI process.

Researchers from Google Threat Intelligence Group, Mandiant and ManageEngine confirmed three tampering windows and said there may have been others. Google identified affected organizations in 11 countries, including the United States, but no total number of infections was disclosed.

On examined computers, the attack installed a scheduled task that ran every three hours. It used a legitimate copy of the Radmin remote-administration program to load a malicious file. The resulting SHINYROAD implant could provide a remote command shell and download additional code.

AOMEI told researchers that it fixed its servers. However, the server repair does not clean computers that already received the backdoor.

Who is affected

Windows users who had AOMEI Backupper installed and running during the May-to-July attack period may be affected. Researchers examined Backupper version 8.3.0, but they did not disclose a complete list of vulnerable or affected versions. That means checking the version number alone cannot confirm that a computer is safe.

AOMEI’s AnyViewer remote-desktop software reportedly uses the same update process, but the reported detections involved Backupper. The source does not establish that AnyViewer delivered the malware.

What to do now

1. Open Settings > Apps > Installed apps in Windows and search for AOMEI Backupper. Record the installed version and whether the program was present between May and July 2026.

2. If Backupper was installed during that period, disconnect the computer from the internet while you investigate. The implant contacted an attacker-controlled address for commands, so taking the PC offline can interrupt that communication.

3. Open Windows Security > Virus & threat protection > Scan options and run a Full scan, followed by a Microsoft Defender Offline scan. Do not assume that installing a newer Backupper release removes an existing backdoor.

4. Open Task Scheduler and look for an unfamiliar task configured to run every three hours, especially one tied to a local Radmin folder. Do not delete uncertain entries blindly; take screenshots and ask a trusted technician to review them.

5. If security software finds the implant or a technician confirms compromise, back up personal documents without copying programs, then reinstall or reset Windows from trusted media. Change important passwords from a different, known-clean device after the computer has been secured.