AOMEI Backupper Malware Attack: How to Check Your PC and Recover Safely

Backup software is supposed to be the reassuring part of your computer setup. It runs quietly, keeps copies, and helps when something else goes wrong.

That familiar background activity is what makes the AOMEI Backupper incident worth understanding, especially if the program has been on your Windows PC for months.

Overview

Attackers abused a legitimate software distribution system

AOMEI Backupper is real backup software. The incident concerns attackers altering its update and notification infrastructure, not a finding that the product itself is a scam.

Google Threat Intelligence Group and ManageEngine researchers documented brief tampering windows in 2026. Some clients checking during those windows could receive malicious instructions.

The genuine vendor page shown above identifies the software. It is not evidence that visiting that homepage infects a computer.

A restored server does not settle the condition of a PC

The reported campaign used a downloader and persistent remote-access components. That means a machine affected earlier needs its own examination even after the distribution problem is fixed.

Researchers identify the downloader as CROSSROAD and the backdoor as SHINYROAD. Their presence must be assessed through actual endpoint evidence, not a user’s ownership of the application alone.

• Check security alerts and relevant installation history.
• Investigate unexpected tasks or executables rather than running them.
• Use a trusted device for sensitive account recovery if compromise is suspected.
• Do not assume uninstalling the backup program removes a separately installed backdoor.

The right response depends on evidence of exposure

If Backupper was installed, review the risk and scan appropriately. If alerts or suspicious artifacts exist, involve technical support and protect the affected machine.

Do not delete backups or conclude that every customer was infected. The documented attack was opportunistic during particular server changes, not a confirmed compromise of all installations.

Why an Update Can Become a Route Into a Computer

Most people think of infection as downloading the wrong installer. A supply-chain attack can instead misuse a channel that software already trusts.

An installed application may ask a server what update exists, where to retrieve it, and how to check the package. That makes the response security-sensitive.

If an attacker changes those instructions, the familiar application can become the messenger for an unfamiliar file. The person at the keyboard may never see a suspicious email.

A secure connection is only part of the answer. It can deliver an altered instruction accurately if the server holding that instruction has been compromised.

That is why identity and integrity need to extend to the delivered package, not just the website connection. The client needs a trustworthy basis for rejecting an unauthorized change.

A checksum can identify whether a file matches an expected value. But if someone can replace both the file location and expected value, matching them provides little reassurance.

Think of receiving a parcel with a packing slip written by the same intruder who swapped the contents. Agreement between the two does not establish authenticity.

Keep installing genuine security updates. But if protection flags an updater’s behavior, do not wave it away simply because you recognize the application that started it.

The Short Windows Explain Why a Later Check May Look Normal

GTIG described repeated server changes lasting only minutes before authentic configurations were restored. Its confirmed examples included windows of ten, six, and five minutes.

A machine polling during an altered interval could encounter a different instruction from one checking shortly before or afterward. Installation dates alone therefore cannot give a clean answer.

A later visit to the same download location may show normal content. That does not tell you exactly what a particular PC received earlier.

For an administrator, timestamps become valuable. Preserve the alert time, software version, download event, process path, and any endpoint log showing what ran.

Do not dismiss an old antivirus detection merely because today’s vendor URL is clean. The relevant question is what happened on the endpoint at the time.

For home users, this is a reason to keep detection history instead of repeatedly clearing notifications. An older alert can help a technician connect events that otherwise look unrelated.

The vendor reportedly took corrective action. That is welcome for the distribution channel, but it does not remove a malicious task or component already placed on a computer.

How the AOMEI Backupper Update Attack Works

Step 1: An installed client checks its normal background channel

The starting point is existing software communicating with its update or promotional infrastructure. The request does not require a customer to seek out a counterfeit download site.

This matters when reconstructing an incident. A person may truthfully say they never opened a strange attachment, while an installed program still received a malicious package.

Step 2: Altered instructions direct the client to another package

The research describes changed configuration data controlling download and notification behavior. During a tampering interval, the expected update workflow could be redirected.

The important issue is unauthorized control of those instructions, not whether the download had a plausible filename. A routine-looking name cannot establish who supplied the contents.

Security teams should trace the initiating process and server response. A file examined without that context can conceal the relationship with the legitimate updater.

Step 3: A downloader stages continuing access

ManageEngine identified an unexpected upgrade-now.exe and a scheduled task called RadminComponentRuntime in the observed chain. The task helps explain why access may survive the initial download.

A scheduled task is simply a way to run something later or repeatedly. Its security meaning depends on its target, arguments, origin, and relationship to other activity.

A familiar administration-tool name is not enough to dismiss the event. Legitimate software can be placed beside malicious components or used in an unauthorized context.

Step 4: The endpoint remains the recovery priority

Once a backdoor is running, removing the original entry point does not necessarily undo what followed. The attacker may have had opportunities beyond the first installed file.

The recovery question becomes broader: what ran, which accounts were used, whether access continues, and how to restore a trustworthy working environment.

That requires evidence-led cleanup. Deleting whichever filename appears in a news article can erase useful clues without establishing that the rest of the computer is safe.

Which Warning Signs Deserve Attention?

Start with your security product’s actual detection history. Record the threat name, path, time, action taken, and whether the item was blocked, quarantined, or allowed.

A blocked attempt and an executed payload are not the same event. Give a technician that distinction rather than summarizing everything as a virus warning.

The reported RadminComponentRuntime task is a useful lead. If you find it, inspect its properties with qualified help; do not double-click the referenced executable to identify it.

Similarly, an unexpected upgrade-now.exe in a Backupper-related location deserves investigation. A filename match alone cannot identify a specific binary without additional checks.

The research also warns that an initial file can remove itself after staging other components. Not finding that file is therefore not an all-clear.

Do not treat every legitimate Radmin installation as malicious. Some organizations use administration software deliberately, and the assigned IT team should distinguish approved use from the attack chain.

If a security alert names an unfamiliar domain, keep the complete alert rather than visiting the domain in your browser. Investigation does not require contacting attack infrastructure.

Unexpected remote sessions, new accounts, or unexplained security-setting changes warrant prompt help. None is uniquely diagnostic of this incident, but each can change the urgency of containment.

What to Do If AOMEI Backupper Was on Your PC

1. Establish the basic history. Note whether the software was installed during the reported April-to-July 2026 period, its version, and any retained security alerts.

   If this is a work computer, notify your IT team before making changes. Include the computer name and alert time, but do not publicly post private logs.

   If you installed only after that period, do not assume historical campaign exposure. Still review any current alert on its own merits.

2. Contain a machine showing credible signs of compromise. Disconnect it from network access and contact trusted technical support. Avoid using it for banking or password changes.

   For a managed device, follow the organization’s isolation process. Do not shut down, wipe, or repeatedly restart it without advice when investigators may need evidence.

   Use another trusted device for urgent communications. Tell support what happened before reconnecting the suspected computer to download tools.

3. Run an appropriate security assessment. For routine checking, update trusted security software and run a full scan. Malwarebytes can provide an additional malware assessment on supported Windows systems.

   Download it through the genuine vendor or a trusted existing guide, not an advertisement promising an AOMEI-specific emergency fix. Save detection results and follow quarantine instructions.

   Microsoft Defender Offline is another option for suitable Windows systems. Save your work first: its scan restarts the PC outside the normal Windows session.

   Our Windows 11 malware-removal guide explains a broader cleanup workflow. A confirmed backdoor may still require professional incident response beyond a scan.

4. Review persistence without destructive guessing. Ask the technician to inspect relevant scheduled tasks, file paths, and process history against the published campaign indicators.

   Do not mass-delete software folders, registry entries, or every remote-management utility. Preserve findings and let the responder distinguish malicious components from normal administration tools.

   AdGuard may reduce malicious advertising exposure during ordinary browsing. It is not a repair for a compromised software updater and cannot remove an installed backdoor.

5. Protect accounts after containment. From a clean device, review important account activity and follow the responder’s advice on changing credentials and ending sessions.

   Prioritize email, administrator access, financial services, and accounts used on the affected machine. Do not assume a new password helps while an intruder still controls the endpoint.

   If the computer handled organizational secrets, notify the responsible security team. It can assess credential exposure without publishing the information itself.

6. Restore trust in the computer and its backups. For a confirmed compromise, ask whether a clean rebuild is safer than relying on uncertain manual cleanup.

   Keep older offline backups separate while they are assessed. Do not overwrite your last known-good copy with a fresh image of the suspect system.

   Resume normal use only after the recovery plan is complete. Record what was checked, what was removed, and what remains uncertain.

Do Not Confuse Backup Recovery With Malware Removal

A backup can preserve valuable files while also preserving an unwanted program. Its usefulness depends on what it contains and when it was created.

Restoring a complete system image made after compromise can bring the problem back. Recovering necessary documents onto a clean system is a different operation.

Ask the responder to identify the earliest credible exposure date before choosing a restore point. A date that merely precedes today’s alert may still be too recent.

Do not connect every backup drive to the suspect PC while trying to find a clean copy. Keep disconnected copies protected until the recovery method is agreed.

For critical data, test the recovery process in a safe environment. A reassuring file count is not the same as opening required documents successfully.

Keep backup credentials separate from routine workstation accounts where practical. That limits the consequences if a future endpoint compromise occurs.

Why Uninstalling or Updating Is Only Part of the Answer

Updating a genuine product can address a distribution or application problem. It does not necessarily inspect every action an intruder took before the update.

Uninstalling the original application likewise removes that application, not automatically another program, task, or account established afterward.

That is why a backdoor finding deserves a defined recovery plan rather than a sequence of hopeful fixes. Ask what evidence will support calling the device clean.

A useful answer names the checks performed and any limits. It should not depend only on the current website loading normally or one file being absent.

Keep real-time protection enabled and obtain future software through established vendor routes. This incident does not justify abandoning operating-system updates or disabling security controls.

Document the recovery decision in plain language. A home user should know whether a scan was routine reassurance, a threat was quarantined, or a complete rebuild was required.

If someone else maintains the computer, agree on what they will inspect and how findings will be communicated. Do not authorize unrelated account access simply to receive a diagnosis.

After recovery, test that scheduled backups still run and that important files can be restored. Security cleanup should not silently leave the next data-loss problem waiting.

Frequently Asked Questions

Is AOMEI Backupper itself a scam?

No. This report concerns abuse of a legitimate distribution channel. It does not classify the genuine backup application or its customers as fraudulent.

Was every Backupper user infected?

No such finding was established. Exposure depended on clients contacting altered infrastructure during particular intervals, and individual machines require their own assessment.

What is RadminComponentRuntime?

It is a scheduled-task name reported in the attack chain. Finding it warrants investigation of the task’s target and history, not blindly executing or deleting files.

Does a clean current update server mean my PC is safe?

No. A server restored after tampering does not remove components installed earlier on an endpoint. Check the computer and its security history.

Is deleting upgrade-now.exe enough?

No. The initial downloader may disappear after staging other components. Cleanup must consider persistence and subsequent activity rather than one filename.

Should I delete all my backups?

No. Preserve them separately and have their dates and contents assessed. Destroying recovery copies can make a difficult incident much worse.

The Bottom Line

Do not ignore a Backupper-related malware alert because the software is genuine. Investigate the endpoint, and isolate it when credible signs point to continuing access.

If no compromise is established, review exposure and scan without panic. If a backdoor is confirmed, use a trusted recovery plan rather than assuming an uninstall has solved it.