When security itself was the problem.Real incidents, in plain words.

ManageEngine’s threat lab, together with Google Threat Intelligence Group and Mandiant, reported that attackers tracked as UNC7017 tampered with AOMEI Backupper’s update files between April and July 2026. Each change lasted only minutes before the files were put back.

Affected machines received a downloader and a backdoor. AOMEI said it upgraded its servers; researchers noted that this stops new infections but doesn’t clean computers that were already hit.

Why it matters. A trusted backup app’s own update channel was used to install backdoors, and the changes lasted only minutes, which made them hard to catch.

On July 9, 2026, Symantec’s Threat Hunter Team reported on GodDamn ransomware, first seen on May 21, 2026. The attackers used a kernel driver called PoisonX that Symantec described as a malicious driver its developers succeeded in getting signed by Microsoft.

The driver was used to stop security processes and remove the hooks that endpoint tools rely on to watch activity. Symantec said one attack spread across at least 10 computers in a single organization.

Why it matters. A trusted signature doesn’t prove a program is safe; here a signed driver was used to switch off endpoint protection.

Kaspersky reported that DAEMON Tools installers on the official site had been tampered with since April 8, 2026, affecting versions 12.5.0.2421 to 12.5.0.2434, and that the modified files carried a valid signature from the developer.

Most infections only collected system information; a backdoor was sent to about a dozen machines at organizations in Russia, Belarus and Thailand. The developer released a clean version, 12.6.0.2445, and said only the free DAEMON Tools Lite was affected.

Why it matters. Software downloaded from the official site and signed by its real developer can still turn out to be malware.

On April 2, 2026, Cisco Talos described malware used in Qilin ransomware attacks whose job is to disable endpoint detection software before the ransomware runs. Talos said it can terminate “over 300 different EDR drivers from almost every vendor in the market.”

Talos recommended layered defenses, so that one control being switched off doesn’t leave a network unprotected.

Why it matters. One tool shared among attackers can blind security products from many different vendors.

On March 19, 2026, ESET published research on “EDR killers”, tools that disable endpoint security before ransomware runs. It counted almost 90 in active use.

Of these, 54 load a legitimately signed but flawed driver to get deep access, abusing 35 different drivers. ESET said these tools are now a standard step in ransomware attacks.

Why it matters. Attackers now plan to switch off endpoint security as a normal part of an attack, not as a rare trick.

On February 2, 2026, Notepad++ said attackers had compromised its former hosting provider and redirected update traffic for selected users to servers they controlled. The intrusion began in June 2025, and the provider said the attackers kept some access until December 2, 2025.

The project said the targeting was highly selective, gave no count of affected users, and wrote that the attacker is likely a Chinese state-sponsored group. Notepad++ moved hosts, added signature checks to its updater and advised users to install version 8.9.1 by hand.

Why it matters. A trusted app’s own update feature delivered attacker files without the app’s code ever being changed.

On January 20, 2026, a regional update server belonging to MicroWorld Technologies, the maker of eScan, delivered a tampered update for about two hours. Researchers at Morphisec found that the file downloaded more malware and blocked further eScan updates, so some users needed a manual fix.

MicroWorld said only a small subset of customers received it and that the problem was in its update servers, not the product. It isolated and rebuilt the servers, changed its credentials and released a patch.

Why it matters. The channel a security product uses to keep itself up to date was turned into a way to deliver malware.

In September 2025 SonicWall said an unauthorized party had reached firewall configuration backup files stored in its MySonicWall cloud service, and told customers to reset their credentials. At first the company said roughly 5% of its firewall customers used the service.

On October 8, 2025, after an investigation with Mandiant, it said the files had been accessed for all customers who used cloud backup. The files contain encrypted credentials and configuration data, which SonicWall warned could make attacks on those firewalls significantly easier.

Why it matters. Settings that customers stored with their security vendor’s cloud for safekeeping became a target in their own right.

On May 28, 2025, ConnectWise said it had found suspicious activity in its environment that it linked to a nation-state actor. The company said the activity affected a very small number of ScreenConnect customers and did not give an exact number.

It brought in Mandiant, worked with law enforcement, contacted the affected customers and added extra monitoring.

Why it matters. Remote-management tools hosted in a vendor’s cloud can reach directly into customers’ computers, so a breach of that cloud puts those customers at risk.

On July 19, 2024, CrowdStrike sent a content update to its Falcon security software on Windows, and computers that received it crashed. Microsoft estimated that the update “affected 8.5 million Windows devices, or less than one percent of all Windows machines.”

Flights were grounded, and Delta Air Lines had to cancel thousands of flights in the days that followed. Many machines had to be fixed by hand. A week later CrowdStrike said more than 97% of Windows sensors were back online.

Why it matters. A single update pushed from a vendor’s cloud to millions of endpoints at once can take down the machines it is meant to protect.