Threat Analysis: AOMEI Supply Chain Compromise, NetScaler RCE, and the ICO's Welsh Wake-Up Call
This is your Daily Threat Analysis for the 20th of October 2026.
Three items today. Each of them is individually significant. Together they form a pattern that any UK small business owner or IT manager should find uncomfortable reading.
AOMEI Backupper: When the Update Is the Attack
Let us start with the one that has the broadest reach.
Between April and July 2026, attackers compromised the update and notification infrastructure belonging to AOMEI Technology, the developer of AOMEI Backupper. The software claims over 100 million users worldwide. During three confirmed tampering windows, lasting ten, six, and five minutes respectively, the attackers modified download instructions to deliver a malicious ZIP archive to users who triggered an update or notification check during those windows.
The initial payload acted as a downloader, pulling a remote access backdoor onto affected machines. The malicious file was named upgrade-now.exe, which is precisely the kind of filename that looks routine in a backup tool’s update workflow and raises no immediate suspicion.
This is a textbook software distribution hijacking. The attacker does not need to compromise your machine directly. They compromise the trusted pipeline that your machine is already configured to accept instructions from. Your endpoint protection does not flag it because the update is arriving through a channel you told it to trust.
What makes this particularly relevant for UK SMBs is the profile of AOMEI Backupper’s user base. It is widely deployed as an affordable, capable backup solution in small and medium business environments, often recommended by IT providers as an alternative to enterprise-priced products. If your IT provider deployed it, they may not yet know the timeline of the tampering windows or whether their clients’ machines requested an update during one of them.
What to do now: Check whether AOMEI Backupper is installed on any of your systems. If it is, check the installation and the processes associated with it against the indicators of compromise published by Malwarebytes. Do not wait for your IT provider to raise this with you. Ask them directly: were any of our machines running AOMEI Backupper during April to July 2026, and have you checked the update logs? If they cannot answer that question, you have a visibility problem that predates this incident.
The NCSC has published guidance on supply chain security and software update integrity. The fact that update infrastructure remains an effective attack vector in 2026 tells you how many organisations have read it.
CVE-2026-88771: NetScaler RCE with a CVSS of 9.8 and Active Exploitation Confirmed
On the 27th of September 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution vulnerability affecting NetScaler Application Delivery Controller and NetScaler Gateway. CVSS score: 9.8. The vulnerability allows an unauthenticated attacker to execute arbitrary commands without requiring any optional features to be enabled. That last detail matters: there is no configuration you can apply to reduce your exposure short of patching or taking the device offline.
CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities catalogue following confirmed exploitation in the wild. Zscaler’s threat research team has published a detailed analysis of the exploitation chain, which includes deployment of web shells and a FreeBSD-based implant for persistence. The researchers also observed chaining with additional CVEs including CVE-2026-107406, CVE-2026-20131, CVE-2026-20253, and CVE-2026-75650, suggesting organised threat actors are not treating this as a single-shot opportunity but as an initial foothold for deeper compromise.
NetScaler devices sit on the perimeter of many organisations as SSL VPN and application delivery infrastructure. In the UK SMB context, they appear most frequently in professional services firms, accountancies, and healthcare practices that have grown to a scale requiring managed remote access but have not yet moved fully to cloud-delivered alternatives. They also appear extensively in supply chains: your managed service provider or your legal firm’s IT infrastructure may be running NetScaler even if you are not.
This is not a new category of problem for NetScaler. CVE-2023-3519 caused significant damage in 2023 through near-identical exploitation patterns, unauthenticated RCE, immediate web shell deployment, fast lateral movement. The advisory attributes this to that established playbook. What it does not say explicitly, but the Zscaler analysis makes clear, is that the exploitation activity observed suggests actors who prepared for this disclosure in advance of the public patch.
What to do now: If you have a NetScaler ADC or Gateway device, confirm your patch status against Citrix’s advisory and apply the relevant update immediately. CISA’s inclusion in the KEV catalogue means US federal agencies face a mandatory remediation deadline; there is no equivalent legal compulsion for UK businesses, but the operational logic is the same. If you use an MSP, ask them to confirm the patch status of any NetScaler devices in your environment in writing. If you cannot get that confirmation today, that is material information about your risk posture.
The ICO’s Welsh Reminder: Forgotten Accounts Kill
This one is closer to home.
The Information Commissioner’s Office has issued reprimands to two Welsh organisations, Ogi Networks and Data Cymru, following a ransomware breach that exposed the personal information of approximately 3,300 people, the majority of whom were children.
The attacker gained initial access through a forgotten test account. The password on that account was Password1.
There is not much analytical distance to put between you and that sentence. This is not a sophisticated supply chain attack. This is not a CVSS 9.8 zero-day. This is an account that someone created, forgot about, and never deprovisioned, secured with a password that any credential-stuffing tool would reach within seconds.
The ICO issued reprimands. The data on those 3,300 people, predominantly children, is gone.
I want to be precise about what a reprimand represents in practice. It is a formal regulatory finding of inadequate data protection practice. It sits below a monetary penalty in the ICO’s enforcement toolkit, but it is a matter of public record, and the ICO has made clear that repeated or aggravated failures will result in escalated enforcement. For organisations handling data on children, schools, youth organisations, councils, healthcare providers, children’s services, the regulatory and reputational stakes are higher still.
The NCSC published guidance on account management hygiene that covers exactly this scenario. Periodic review of dormant and test accounts, enforcement of a password policy that does not permit Password1 under any circumstances, and MFA on all external-facing accounts. None of that is complicated. None of it is expensive. All of it was absent here.
If your IT provider tells you this does not affect you because you are too small, ask them when they last audited your dormant and test accounts, and whether they can show you the results.
What to do now: Pull a list of all user accounts in your environment. Flag anything that has not been used in the past 90 days. Disable or delete accounts that have no current operational purpose, particularly any created for testing, onboarding, or temporary access. Check that your password policy explicitly blocks common passwords, Password1, Welcome1, Summer2026 and their variants are trivially guessable and remain in widespread use. If you have external-facing systems, confirm that MFA is enforced on every account without exception.
This takes an afternoon. The breach it prevents takes considerably longer to recover from.
One Additional Note: MSP Credential Exposure in Microsoft 365
For completeness, and because it has direct relevance to any UK business using a managed service provider: Huntress published research on the 15th of October 2026 documenting the compromise of a Microsoft 365 API credential belonging to ConnectWise Cloud Backup, formerly known as SkyKick. The threat actor used that single compromised credential to authenticate across hundreds of customer tenants, moving through them in sorted GUID order, a pattern consistent with automated tooling designed for bulk tenant access.
The advisory tracks this to CVE-2025-11371. The wider point is this: your MSP’s access to your M365 environment is only as secure as the weakest credential in their platform. If your MSP uses ConnectWise Cloud Backup or any similar multi-tenant management tool, ask them whether they were affected and what access logging exists for your tenant. You are entitled to that information. Ask for it.
Summary: Three Actions Before End of Day
- AOMEI Backupper, Check whether it is installed. If it is, check against published indicators of compromise. Ask your IT provider for confirmation.
- NetScaler CVE-2026-88771, Confirm patch status of any NetScaler devices in your perimeter or your MSP’s infrastructure. Get written confirmation.
- Account hygiene, Audit dormant and test accounts. Disable anything with no current purpose. Enforce a password policy that blocks trivially guessable credentials. Ensure MFA is active on all external-facing accounts.
None of these require specialist skills or significant budget. All of them map to known failures that cost real organisations real money and real regulatory exposure in 2026.
If today’s analysis is useful to you, follow Threat Analysis wherever you listen so tomorrow’s briefing arrives automatically. And if someone in your network runs a business or manages IT for one, send this to them. The information only works if it reaches the people who need it.
Sources
| Source | Title | Link |
|---|---|---|
| Malwarebytes | AOMEI Backupper update servers hijacked to push malware: Check your PC | https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc |
| Zscaler | CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability | https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability |
| The Register | ’Password1’ and a forgotten test account land Welsh outfits in hot water | https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139 |
| Huntress | Vendor Credential Enables Unauthorized Access (ConnectWise/SkyKick M365) | https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access |
| Expel | QuartzLine: A working PDF viewer with a backdoor inside | https://expel.io/blog/quartzline-a-working-pdf-viewer-with-a-backdoor-inside/ |