AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

•

Episode description

AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

Three recent incidents expose fundamental gaps in UK business security practice. AOMEI Backupper, backup software deployed across millions of systems, suffered a supply chain compromise between April and July 2026 when attackers tampered with update infrastructure during brief windows, delivering remote access backdoors to users who triggered legitimate update checks. Citrix NetScaler devices face active exploitation of CVE-2026-88771, a critical remote code execution vulnerability with no workaround, as attackers deploy web shells and chain additional vulnerabilities for persistent access. The ICO has issued reprimands to two Welsh organisations following a ransomware breach affecting 3,300 people, predominantly children, after attackers gained entry through a forgotten test account secured with the password Password1. Additional reporting covers the compromise of a Microsoft 365 API credential belonging to ConnectWise Cloud Backup, which enabled automated bulk access across hundreds of customer tenants. The briefing provides actionable guidance for checking AOMEI exposure, confirming NetScaler patch status, auditing dormant accounts, and interrogating MSP access logging. None of these failures required sophisticated attack techniques. All map to existing NCSC guidance that remains unimplemented across UK SMB environments.

Chapters

  • Introduction Daily threat briefing for 20 October 2026 covering three incidents that map where UK businesses continue to leave security gaps: a supply chain attack in trusted backup software, critical network infrastructure exploitation, and a breach starting with a test account using Password1.
  • AOMEI Backupper Supply Chain Compromise Attackers compromised AOMEI Backupper update infrastructure between April and July 2026, delivering malicious payloads during brief tampering windows. Over 100 million users worldwide, with significant UK SMB deployment. Guidance on checking for indicators of compromise and interrogating IT providers about exposure across their client base.
  • Mid-Episode Call to Action Brief reminder to follow the show and share with business owners and IT managers.
  • NetScaler Remote Code Execution CVE-2026-88771 Citrix NetScaler devices face active exploitation of a critical vulnerability with CVSS score 9.8. No workaround exists. Attackers deploy web shells and chain additional CVEs for persistence. Guidance on obtaining written confirmation of patch status from MSPs and understanding the absence of UK mandatory remediation deadlines.
  • ICO Reprimands for Welsh Organisations ICO has issued reprimands to Ogi Networks and Data Cymru following a ransomware breach affecting approximately 3,300 people, predominantly children, after attackers accessed a forgotten test account with the password Password1. Guidance on auditing dormant accounts, enforcing password policies, and implementing multi-factor authentication.
  • MSP Credential Exposure in Microsoft 365 Huntress research documents compromise of ConnectWise Cloud Backup Microsoft 365 API credential, enabling bulk automated access across hundreds of customer tenants. Guidance on interrogating MSPs about their credential hygiene, access logging, and exposure to this specific incident.
  • Closing Summary Three immediate actions: check AOMEI Backupper installations against published indicators, obtain written confirmation of NetScaler patch status, and audit dormant and test accounts. All three failures map to existing guidance; the gap is implementation, not knowledge.

Links

No chapters are available for this episode.