Hackers hijack AOMEI update servers to secretly spread malware

Threat actor UNC7017 compromised AOMEI's software update infrastructure, silently redirecting legitimate update requests to malicious ZIP archives without any user interaction required. This is a classic supply chain attack: users inherently trust software update mechanisms, making them a high-value and low-resistance attack vector. The brief, targeted modification of configuration files meant the attack could fly under the radar of both the vendor and end users. This incident demonstrates that even trusted, widely-used software tools can become weapons if their distribution pipeline is not hardened and continuously monitored.