AOMEI Backupper Supply Chain Hijack — upgrade-now.exe Backdoor: OTX Pulse Analysis & Enterprise Detection Pack

---
title: AOMEI Backupper Malicious Update Execution - upgrade-now.exe
id: 7f3a2c1e-9b4d-4e8a-a1c5-2d6f8e0b1a34
status: experimental
description: Detects execution of the malicious upgrade-now.exe downloader distributed via compromised AOMEI Backupper update infrastructure (April-July 2026 supply chain compromise)
author: Security Arsenal Threat Intelligence
references:
    - https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc
date: 2026/10/19
logsource:
    category: process_creation
    product: windows
detection:
    selection_filename:
        Image|endswith: '\upgrade-now.exe'
        OriginalFileName: 'upgrade-now.exe'
    selection_child_of_aomei:
        ParentImage|contains:
            - '\AOMEI\'
            - 'Backupper'
        CommandLine|contains:
            - 'upgrade'
            - 'update'
    condition: selection_filename or selection_child_of_aomei
falsepositives:
    - Legitimate AOMEI update processes during the tampering window require verification of download source
level: high
tags:
    - attack.initial_access
    - attack.t1195.002
---
title: Network Connection to AOMEI Supply Chain Staging Domain
id: 8e4b3d2f-0c5e-5f9b-b2d6-3e7a9f1c2b45
status: experimental
description: Detects DNS resolution or network connections to storage-data.com infrastructure used to deliver the upgrade-now.exe backdoor via hijacked AOMEI update servers
author: Security Arsenal Threat Intelligence
references:
    - https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc
date: 2026/10/19
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains: 'storage-data.com'
    selection_dns:
        QueryName|contains: 'storage-data.com'
    condition: selection_domain or selection_dns
falsepositives:
    - None expected; domain is attacker-controlled
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Suspicious Persistence Masquerading as AOMEI Update Component
id: 9f5c4e3a-1d6f-6a0c-c3e7-4f8b0a2d3c56
status: experimental
description: Detects registry Run key or scheduled task persistence using AOMEI-plausible names or referencing upgrade-now, consistent with backdoor persistence following the AOMEI supply chain compromise
author: Security Arsenal Threat Intelligence
date: 2026/10/19
logsource:
    category: registry_event
    product: windows
detection:
    selection_runkey:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\RunOnce'
        Details|contains:
            - 'upgrade-now'
            - 'storage-data'
    selection_unsigned_aomei_path:
        TargetObject|contains: '\CurrentVersion\Run'
        Details|contains: '\AOMEI'
    condition: selection_runkey
falsepositives:
    - Legitimate AOMEI Backupper autostart entries; verify binary signer is AOMEI Technology Co.
level: high
tags:
    - attack.persistence
    - attack.t1547.001

// AOMEI Supply Chain Compromise Hunt - storage-data.com infrastructure & upgrade-now.exe
// Microsoft Sentinel / Defender XDR
let lookback = 200d; // Covers April 2026 tampering window start
let maliciousDomains = dynamic(["storage-data.com", "aomei.storage-data.com", "promotion.storage-data.com"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated >= ago(lookback)
    | where RemoteUrl has_any (maliciousDomains)
    | project NetworkTime=TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits = DeviceEvents
    | where TimeGenerated >= ago(lookback)
    | where ActionType == "DnsQueryResponse"
    | extend Query = tostring(parse_json(AdditionalFields).DnsQueryString)
    | where Query has_any (maliciousDomains)
    | project DnsTime=TimeGenerated, DeviceName, DeviceId, Query;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName =~ "upgrade-now.exe" or ProcessCommandLine has_any ("upgrade-now", "storage-data")
    | project ProcessTime=TimeGenerated, DeviceName, DeviceId, FileName, ProcessCommandLine, FolderPath, SHA256, InitiatingProcessFileName;
NetworkHits
| union DnsHits, ProcessHits
| sort by DeviceName

# AOMEI Supply Chain Compromise - Endpoint IOC Hunt Script
# Checks for upgrade-now.exe artifacts, malicious persistence, and network indicators
# Run elevated; outputs findings to console and C:\IR\AOMEI_Hunt_Results.csv

$results = @()
$outDir = "C:\IR"
if (-not (Test-Path $outDir)) { New-Item -ItemType Directory -Path $outDir | Out-Null }

Write-Host "[*] Hunting for upgrade-now.exe binaries on disk..." -ForegroundColor Cyan
$suspectPaths = @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:ProgramData", "$env:LOCALAPPDATA", "$env:APPDATA", "$env:TEMP", "$env:USERPROFILE\Downloads")
foreach ($p in $suspectPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Filter "upgrade-now.exe" -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            $results += [PSCustomObject]@{Type="File"; Artifact=$_.FullName; Detail="Signer: $($sig.SignerCertificate.Subject) | Status: $($sig.Status) | SHA256: $((Get-FileHash $_.FullName -Algorithm SHA256).Hash)"}
        }
    }
}

Write-Host "[*] Checking Run/RunOnce persistence keys..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty -Path $key -Name $_.Name).$($_.Name)
            if ($val -match "upgrade-now|storage-data") {
                $results += [PSCustomObject]@{Type="Persistence-Registry"; Artifact="$key\$($_.Name)"; Detail=$val}
            }
        }
    }
}

Write-Host "[*] Checking scheduled tasks for suspicious AOMEI/upgrade entries..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $actions = ($task.Actions | Out-String)
    if ($task.TaskName -match "upgrade-now" -or $actions -match "upgrade-now|storage-data") {
        $results += [PSCustomObject]@{Type="Persistence-ScheduledTask"; Artifact=$task.TaskName; Detail=$actions.Trim()}
    }
}

Write-Host "[*] Checking DNS cache for storage-data.com resolution..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "storage-data\.com" } | ForEach-Object {
    $results += [PSCustomObject]@{Type="DNS-Cache"; Artifact=$_.Entry; Detail="Resolved: $($_.Data)"}
}

Write-Host "[*] Checking active/recent connections to storage-data.com..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" } | ForEach-Object {
    try {
        $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
        if ($rdns -match "storage-data\.com") {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            $results += [PSCustomObject]@{Type="Network-Active"; Artifact="$($_.RemoteAddress):$($_.RemotePort) ($rdns)"; Detail="Process: $($proc.ProcessName) PID $($_.OwningProcess)"}
        }
    } catch {}
}

if ($results.Count -gt 0) {
    Write-Host "[!] $($results.Count) INDICATOR(S) FOUND - host may be compromised" -ForegroundColor Red
    $results | Format-Table -AutoSize
    $results | Export-Csv "$outDir\AOMEI_Hunt_Results.csv" -NoTypeInformation
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}