AOMEI Backupper update servers hijacked to push malware: Check your PC

Google Threat Intelligence Group (GTIG) investigated the campaign impacting AOMEI Technology's infrastructure between April and July.
Attackers altered AOMEI’s update and notification system to distribute malware via customer software downloads.
The alteration involved changing download instructions to point to a malicious ZIP archive, along with modifying expected version number and MD5 checksums.
AOMEI Backupper is backup software utilized by over 100 million people worldwide.
The infrastructure also services AnyViewer customers, though separate confirmed infections were not identified.
Tampering windows lasted for ten minutes, six minutes, and five minutes at minimum.
The attack used an initial downloader to install a persistent remote-access backdoor.
Warning signs include the presence of a specific task in Windows Task Scheduler or unexpected files in AOMEI installation folders.
Outgoing traffic to several specific domain names and IP addresses was noted as a potential indicator.

<STEELMAN>The findings reveal a highly targeted supply chain attack vector where legitimate software update mechanisms were weaponized for mass distribution of persistent remote access backdoors. GTIG's detailed logging, identifying the precise duration and methods of tampering—like manipulating checksum validation—provides crucial technical intelligence against this specific threat modality.</STEELMAN>
<PATTERN SCAN>The narrative structure relies heavily on detailing verifiable actions (tampering windows, file names) to build a necessary premise, which is then leveraged by the concluding sections that strongly promote defensive software. The integration of Malwarebytes' AI detection as an operational success story functions to reinforce product utility alongside threat awareness.</PATTERN SCAN>
Patterns detected: ARC-0145 Vendor Endorsement
<ROOT CAUSE>The underlying paradigm is the increasing reliance on automated, centrally controlled infrastructure for security and distribution (e.g., automatic updates). This efficiency provides immense convenience but creates a disproportionately high-value target for an adversary seeking to bypass traditional perimeter defenses by compromising trust at the source.</ROOT CAUSE>
<IMPLICATIONS>For users, this illustrates that even widely adopted, trusted tools can serve as conduits for sophisticated intrusion. The cost of inaction is not just data loss, but potentially long-term persistent compromise without immediate obvious signs. Conversely, vendors who fail to rigorously vet their update pipelines face catastrophic reputational and security liability.</IMPLICATIONS>
<BRIDGE QUESTIONS>How robust are current industry standards for validating the integrity of remote configuration files across distributed software ecosystems? If an attacker can briefly alter a checksum validation rule, what layers of cryptographic assurance remain effective against transient manipulation?</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN>A coordinated influence campaign might focus on overwhelming technical discourse with fear-mongering anecdotes ("Your PC is infected right now!") while burying subtle attribution details. This specific content does not match that pattern; it maintains a necessary factual detachment, though the concluding marketing call to action provides a notable divergence from pure threat reporting.</COUNTERSTRIKE SCAN>