Researchers disclose malware delivery through AOMEI software infrastructure

Researchers disclosed a campaign that reportedly used AOMEI Backupper's update and notification infrastructure to install malware, BleepingComputer reported. ManageEngine, Google's Threat Intelligence Group and Mandiant investigated attacks conducted between April and July 2026. Attackers briefly changed configuration files to redirect downloads and execute malware without user interaction, then restored the files within minutes. They also changed an expected checksum so a malicious archive passed verification. Researchers identified affected organizations across IT services, telecommunications and higher education. AOMEI says it upgraded servers and patched potential vulnerabilities, and its CTO is investigating. ManageEngine warns that server repairs do not remove backdoors already installed on customers' computers.