AOMEI

A threat actor tracked as UNC7017 briefly compromised AOMEI’s update infrastructure between April and July 2026, using the software’s built-in promotional feature to distribute malware to organisations across multiple sectors and countries. The attacks, which relied on short windows of tampering with configuration files, were uncovered by researchers at ManageEngine’s Threat Analysis Lab working with Google’s Threat Intelligence Group and Mandiant.