Know what changed.
Trace why it matters.

GTIG reports that attackers compromised AOMEI Technology’s update and notification infrastructure during a campaign investigated between April and July, affecting the mechanism used by AOMEI Backupper to deliver software updates. During three confirmed tampering windows lasting 10, 6, and 5 minutes, attackers redirected downloads to a malicious ZIP archive and changed the expected version and MD5 checksum so the client would accept it; more windows may have occurred.

The attack installed a persistent remote-access backdoor capable of running commands and installing additional malware; the researchers did not identify the delivered malware as ransomware or an infostealer.

Recently fixed Plex Media Server vulnerabilities were reported under active exploitation; successful attacks installed malware, including cryptominers and residential proxy software. A researcher disclosed an exploit chain called “Plex2Shell” that chained four vulnerabilities to achieve remote code execution on a device running a vulnerable Plex version.

A honeypot tracking exploitation attempts saw active scanning within a day and later recorded successful attempts to infect devices.

An unauthorized party accessed and copied California student information from an ETS-operated secure file transfer protocol site after using compromised login details; access occurred at various times between May 22 and September 18. The breach includes all students enrolled during the previous three school years, although the affected population is broader than that group.

The files may reveal highly personal information about students’ education and disabilities, while Social Security numbers, financial account information, passwords, and parent or guardian information were not involved.