This statement presents AOMEI’s investigation findings and security recommendations regarding the supply chain incident, based on the information available as of the last update. The findings and recommendations may be updated as the investigation progresses.
Incident Overview
Recent research by Google Threat Intelligence Group (GTIG) and Mandiant, in collaboration with ManageEngine Threat Analysis Lab (METAL), identified a software supply chain compromise campaign attributed to a threat cluster tracked as UNC7017. The attack involved repeated, short-burst configuration tampering, in which the threat actor modified server configuration files for only a few minutes before reverting them to their original contents. This approach made the activity difficult to detect through traditional security checks and complicated subsequent investigations. During these windows, the altered configurations could direct the software to download malicious files. According to GTIG and Mandiant, this was the first time they had encountered a software supply chain compromise involving such brief tampering windows.
According to the investigation report, between April and July 2026, UNC7017 conducted short-burst configuration tampering on the AOMEI Backupper update server. During the observed tampering windows, the modifications remained active for approximately five to ten minutes before the files were reverted to their legitimate contents.
After being notified of the incident, AOMEI launched an investigation and began responding to the incident.
By July 29, 2026, we had taken security hardening measures on the relevant update servers. According to subsequent feedback from the security researchers involved, they had not observed further attack activity related to this incident within the scope of their monitoring.
On August 5, 2026, we migrated the relevant update server to a new server with additional security controls and further strengthened server-side security.
On October 19, 2026, we released AOMEI Backupper 8.5.1. This version addresses the related security issues identified to date and includes corresponding security safeguards.
We are continuing our investigation to better understand the scope of potentially affected users, as the attack occurred within brief time windows and its impact may have varied depending on device conditions. Three tampering windows have been identified so far. Devices that received the modified configuration files during these periods may have been at risk:
- May 28, 2026: a 10-minute exposure window (05:40–05:50 UTC)
- July 16, 2026: a 6-minute exposure window (08:33–08:39 UTC)
- July 20, 2026: a 5-minute exposure window (10:35–10:40 UTC)
For further details, please refer to: https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering
We sincerely apologize for any concern this incident may have caused and for the additional steps we are asking you to take. We take this incident seriously and will provide guidance and technical support to help you address any potential risks.
Actions We Have Taken
AOMEI has treated this incident as a high priority since receiving the notification. Our response is being led by the company’s CTO, with direct involvement from our security team. We are working to put the most effective measures in place as quickly as possible. If you need assistance, please contact our security team at [email protected]. We will provide support based on your specific questions.
Software Measures
- We have disabled the affected in-app update mechanisms, including those related to promotional campaigns and automatic updates to new software versions.
- We have added asymmetric encryption protection for remote configuration files (.ini).
- We have discontinued use of the download domain identified in the report: www2.aomeisoftware.com.
- We have added signature verification for configuration files. The client rejects configuration files that fail signature verification.
Server Measures
- We have taken the AOMEI Backupper update server (aomeisoftware.com) offline.
- We have migrated update services to a new server with additional security controls.
- In version 8.5.1, we have separated software updates from marketing notification configurations and their associated download resources.
- We have implemented allowlisting and enhanced security verification measures to strengthen controls over software update sources.
- We have strengthened server monitoring to provide timely alerts for suspicious logins, unauthorized access, and other policy violations.
Actions You Can Take
Your device’s security is important to us. Regardless of whether your device may have been affected, we recommend that all AOMEI Backupper users complete the following steps in order:
Step 1: Scan Your PC with AOMEI Security Scanner
Updating to AOMEI Backupper 8.5.1 does not replace checking whether your device may have been affected by this incident. For added peace of mind, we recommend downloading and running AOMEI Security Scanner to check for currently known indicators associated with this incident. If you need help using the scanner, please contact our security team at [email protected]. We will continue to monitor the tool’s effectiveness and update it as needed.
Download URL:
https://go.aomeitech.com/dl/sec/AOMEI_Security_Scanner.exe
Digital signature:
AOMEI International Network Limited
SHA-256:
af9e724d54b0b06fc78e1230838193de0e3562e481d8aec8823f662c2f02fd68
As the tool is updated, the downloadable file and its SHA-256 hash may change. Please refer to the latest version information and SHA-256 hash published in AOMEI's official security statement.
Step 2: Download the Latest Version of AOMEI Backupper
We have taken steps to disable the update services previously involved in this incident to reduce the risk of similar attacks affecting users through that update channel again. AOMEI Backupper 8.5.1 also includes additional security safeguards within the software. If you are using a version earlier than 8.5.1, we recommend updating to the latest version as soon as possible.
Download URL:
https://www.aomeitech.com/download.html
Step 3: Scan Your System with Security Software
Even after updating to AOMEI Backupper 8.5.1 and running AOMEI Security Scanner, other security risks on your device cannot be completely ruled out. We recommend updating the security software currently installed on your computer and running an initial scan. If the scan does not provide a conclusive result, we also recommend installing Malwarebytes Free from an official source for further checks. According to Malwarebytes’ published analysis, its security products can detect some of the known malicious samples identified in this attack.
Step 4: Additional Security Precautions
During this incident, some devices may have been at risk of exposing their Windows authentication-related information. This does not mean that we have confirmed your Windows authentication information was exposed, but there may still be risks to account security. As a precaution, we recommend changing the password for the Windows account or domain account you use on this device. If you use the same credentials on other devices, please update the passwords on those devices as well. Please note that changing your Windows Hello PIN alone is not enough and does not replace the need to change your Windows account password.
How to Get Help
Based on the information currently available from our investigation, AOMEI is assessing which users may be at risk. We are continuing to notify relevant users and work with them to implement appropriate security measures. If you need assistance, please contact us directly. Our team will provide technical support based on your specific questions. If you need remote assistance, we would be happy to help.
Dedicated contact for this incident: [email protected]
Finally, we thank Google Threat Intelligence Group (GTIG), Mandiant and ManageEngine Threat Analysis Lab (METAL) for discovering and analyzing this incident, and for their contributions to protecting the broader software ecosystem. This incident has also driven AOMEI to further improve its software update mechanisms and strengthen related security measures. We hope that sharing our findings so far and the steps we have taken can serve as a useful case study for the security community and the broader software industry. We also hope it will help others better understand these types of supply chain attacks and reduce the risk of similar incidents.
AOMEI Security Team