# Researchers disclose malware delivery through AOMEI software infrastructure

_Published Monday, October 19, 2026 at 4:45 PM EDT · Security · Latest · Tier 2 — Notable_

![Researchers disclose malware delivery through AOMEI software infrastructure — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/19/backupper-supply-chain-attack.jpg)

Researchers disclosed a campaign that reportedly used AOMEI Backupper's update and notification infrastructure to install malware, BleepingComputer reported. ManageEngine, Google's Threat Intelligence Group and Mandiant investigated attacks conducted between April and July 2026.

Attackers briefly changed configuration files to redirect downloads and execute malware without user interaction, then restored the files within minutes. They also changed an expected checksum so a malicious archive passed verification. Researchers identified affected organizations across IT services, telecommunications and higher education.

AOMEI says it upgraded servers and patched potential vulnerabilities, and its CTO is investigating. ManageEngine warns that server repairs do not remove backdoors already installed on customers' computers.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/)

---
Canonical: https://techandbusiness.org/newswire/BI_feq_ZkjLpKXDF9FeEcd
Published: 2026-10-19T20:45:25.844Z
Story chronology: 2026-10-19T19:40:58.000Z
Retrieved: 2026-10-19T22:50:43.650Z
Publisher: Tech & Business (techandbusiness.org)