AOMEI Backupper Malware: How to Check Your PC for the Update Server Backdoor

Attackers took over AOMEI’s update system for a few minutes at a time in 2026 and used it to plant a remote-access backdoor on Windows PCs running AOMEI Backupper. If you have Backupper (or AnyViewer) installed, you can check your machine yourself in about 15 minutes. This guide shows you what happened, which signs to look for, and what to do if you find one.

Is AOMEI Backupper Hacked? What Happened to Its Update Servers

Attackers gained the ability to edit files on AOMEI’s own update servers and swapped in malicious instructions during short bursts.

AOMEI Backupper runs background services that regularly contact AOMEI’s servers to look for updates and promotional pop-ups. Two small text configuration files control that process:

• down_html.ini tells the program which package to download and which checksum to expect.
• Notifycfg.ini tells the pop-up service what to show and what to launch.

AOMEI never signed either file. Worse, the checksum that confirms a download sits inside the same file that names the download. So when the attackers edited that file, they changed the package and its “proof” of authenticity at the same time. Backupper accepted the fake package as genuine and ran it.

Nobody exploited a bug in the traditional sense. Users did not have to click anything. The program only had to be installed and running when it checked in.

AOMEI Backupper Attack Timeline: Dates and Affected Countries

Researchers confirmed three short windows, and they believe more took place that nobody caught.

Any copy of Backupper that polled the servers inside one of these windows pulled the malicious package. Copies that checked a minute earlier or later received clean files. That randomness made the campaign opportunistic rather than targeted, and it also made it very hard to spot. Investigators found victims in IT services, telecom and higher education across 11 countries, including the United States, India, Australia, Brazil and several European nations.

Security teams recommend treating the entire April to July 2026 period as risky, since unseen windows likely exist.

How to Check Your PC for AOMEI Backupper Malware

Run these checks on every Windows PC that had AOMEI Backupper or AnyViewer installed between April and July 2026.

Step 1: Find the RadminComponentRuntime Scheduled Task

The backdoor relies on a scheduled task to restart itself, so this check gives you the clearest signal.

1. Press Win + R, type taskschd.msc, and press Enter.
2. Click Task Scheduler Library in the left pane.
3. Scan the list for a task named RadminComponentRuntime or NitroRuntime.

You can also run this in PowerShell:

Get-ScheduledTask | Where-Object { $_.TaskName -match 'RadminComponentRuntime|NitroRuntime' }

If the command returns anything, treat the PC as infected.

Step 2: Look for upgrade-now.exe in the AOMEI Folder

The downloader hides among AOMEI’s promotional files, so check the html folders inside the install directory.

1. Open File Explorer and go to the Backupper install folder, usually C:\Program Files (x86)\AOMEI\AOMEI Backupper\.
2. Open the version-specific folder and look inside the html and Tmphtml subfolders.
3. Look for upgrade-now.exe or an unexpected upgrade-now.zip.
4. Right-click any .exe you find, select Properties, and open the Digital Signatures tab. A missing signature on a file carrying AOMEI’s name is a red flag.

Keep in mind that the downloader deletes itself after it runs. An empty folder does not prove your PC is clean, so always complete Step 1 and Step 3 too.

Step 3: Check AppData for a Radmin Folder

Look for Radmin files in your AppData folders if you never installed Radmin yourself.

1. Press Win + R, type %AppData%, and press Enter.
2. Check for a Radmin folder. Repeat with %LocalAppData%.

A Radmin folder you did not create, especially one holding DLL files, points to this campaign.

Step 4: Block the storage-data.com Domains and IPs

Connections to the attacker’s infrastructure confirm an infection, and blocking them cuts off the backdoor.

Watch your firewall, router or security software logs for traffic to these addresses, whether blocked or allowed:

• Domains: storage-data.com, promotion.storage-data.com, aomei.storage-data.com
• IP addresses: 8.210.84.56, 8.218.65.184, 47.239.60.117

To block the domains on a single PC, open Notepad as administrator, open C:\Windows\System32\drivers\etc\hosts, and add:

0.0.0.0 storage-data.com
0.0.0.0 promotion.storage-data.com
0.0.0.0 aomei.storage-data.com

To block the IPs, run this in an admin PowerShell window:

New-NetFirewallRule -DisplayName "Block AOMEI attacker IPs" -Direction Outbound -RemoteAddress 8.210.84.56,8.218.65.184,47.239.60.117 -Action Block

The SHINYROAD implant talks to only one hard-coded address with no fallback, so blocking it severs the attacker’s control.

Step 5: Run a Full Malware Scan

Update your antivirus definitions first, then run a full system scan rather than a quick scan. Current Microsoft Defender, Malwarebytes and most major security tools now detect the downloader.

What the AOMEI Backdoor Does to Your PC (CROSSROAD and SHINYROAD)

The package installs a hidden remote-access backdoor that survives reboots and lets the attacker run commands.

The infection chain works in stages:

1. CROSSROAD downloader. This first file (seen as upgrade-now.exe) unpacks a bundle into a Radmin folder, creates a scheduled task that runs every three hours, and then deletes itself.
2. Signed Radmin as a cover. The bundle includes a real, digitally signed copy of Radmin, a legitimate remote admin tool. The scheduled task launches it, and it quietly loads a malicious DLL placed next to it.
3. SHINYROAD backdoor. That DLL loads the actual implant, which gives the attacker a remote shell and lets them push new code at any time.
4. Adaptix C2 add-on. On some machines, the attackers dropped a second control tool disguised as Nitro PDF software.

The downloader also skips machines located in China and machines running certain security products. Because the malware runs with the privileges of the AOMEI service, it often gets system-wide access.

July 20 Trick That Leaks Your Windows Password Hash

The July 20 window added something extra that needed no program to run at all. The altered pop-up file opened an invisible one-pixel window that pointed to a file on an attacker server over WebDAV. When Windows tries to load that file, it can send your NetNTLMv2 login hash to the attacker, who can then try to crack it offline or reuse it. Even a PC where antivirus blocked the backdoor could still have leaked this hash.

Does Updating AOMEI Backupper Remove the Malware?

No. AOMEI secured its servers, but that only stops new infections and does nothing for PCs already compromised.

AOMEI told researchers in late July that it had fixed its servers. However, the backdoor already sitting on a machine keeps running through its scheduled task. The downloader also restores the original update file after it finishes, so an infected AOMEI folder can look completely normal.

As of the latest release, Backupper 8.5.0 (October 9, 2026), the changelog shows no change to how the program verifies its update files. So the design weakness that allowed this attack still appears to exist.

Also, do not test a suspicious file by comparing it with a fresh download from AOMEI’s website. The site serves genuine files almost all the time, so that comparison will mislead you into calling a real infection a false alarm.

What to Do If Your PC Has the AOMEI Backdoor

Act quickly but avoid simply uninstalling AOMEI, because the backdoor runs independently of the main program.

• Disconnect the PC from Wi-Fi and Ethernet right away.
• Do not wipe evidence if the machine belongs to a business. Your IT or security team will want the AOMEI folders and scheduled task intact for investigation.
• Change your passwords from a different, clean device. Start with your Windows account, email, and any NAS or cloud credentials saved inside Backupper, since attackers target backup storage to destroy recovery data.
• Reset or reinstall Windows for the most reliable cleanup on a home PC. Manual removal can miss hidden components.
• Reinstall AOMEI only if you still trust it, and download it straight from the official site afterward.

How to Protect Your PC From Update Server Attacks

A few habits reduce your exposure to this kind of supply chain attack in any software.

• Turn off automatic update checks in AOMEI Backupper and AnyViewer. Update manually and check the installer’s digital signature before running it.
• Block outbound SMB (TCP 445) and WebDAV to the internet on your firewall. This stops the silent credential leak trick used on July 20.
• Keep real-time protection on, because behavior-based detection catches threats that file scans miss.
• Consider alternatives with signed update channels if your backup tool runs with admin rights on sensitive machines. Windows has built-in File History and System Image tools, and other backup vendors sign their update metadata.

Frequently Asked Questions

Read More

• Rank Math PRO Malware: How to Check, Clean and Secure Your WordPress Site (CVE-2026-111862)
• MatchBoil Malware Explained: How UAC-0099 Uses It to Install the MatchWok Backdoor on Windows
• How to Build a SASE Framework From Assessment to Rollout