Updated on October 19, 2026
Incident Overview
Recent monitoring by GTIG (Mandiant) and ManageEngine identified activity by a threat actor tracked as UNC7017 that tampered with configuration files on AOMEI Backupper's update server between April and July 2026. Each tampering window lasted five to ten minutes, after which the legitimate contents were restored. According to the published findings, this was the first software supply chain compromise the researchers had encountered using such brief tampering windows.
After receiving the notification, AOMEI investigated the incident and completed remediation of the upgrade server in July. In a subsequent email, GTIG confirmed that it had not observed any further related attack activity following the remediation.
AOMEI Backupper version 8.5.1 was released on October 19, 2026. This version comprehensively blocks the potential attack paths associated with this incident at the software level. We are continuing our investigation to establish the full scope of impact, given the malware’s clear environment-screening behavior and selective use of execution windows. Based on GTIG’s observations, users whose AOMEI Backupper installations checked for updates during the following windows may have been at risk:
- May 28: a 10-minute exposure window (05:40–05:50 UTC)
- July 16: a 6-minute exposure window (08:33–08:39 UTC)
- July 20: a 5-minute exposure window (10:35–10:40 UTC)
For further details, please refer to: https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering
Actions We Have Taken
AOMEI has treated this incident as a high priority since receiving the notification. Our response is being led by the company’s CTO, with direct involvement from our security team. We are working to put the most effective measures in place as quickly as possible. If you need assistance, please contact [email protected]. Our CTO will respond as promptly as possible.
Software Measures
- We have disabled the affected in-app update mechanisms, including those related to promotional campaigns and automatic updates to new software versions.
- We have added asymmetric encryption protection for remote configuration files (.ini).
- We have discontinued use of the download domain identified in the report: www2.aomeisoftware.com.
Server Measures
- We have taken the AOMEI Backupper upgrade server (aomeisoftware.com) offline.
- We have migrated update services to a new server from a well-known provider with more comprehensive security controls.
- In version 8.5.1, we have separated software updates from marketing notification configurations and their associated download resources.
- We have implemented server allowlisting. The software permits only trusted files from AOMEI’s official websites to be downloaded and installed.
- We have strengthened server monitoring to provide timely alerts for suspicious logins, unauthorized access, and other policy violations.
Actions You Can Take
If you used AOMEI Backupper during the exposure windows, or are concerned that your device may have been affected, follow the steps below to check for signs of compromise.
Download the Latest Version of AOMEI Backupper
Download AOMEI Backupper 8.5.1, the latest version, which addresses this issue.
Scan Your PC with AOMEI Security Scanner
AOMEI has released AOMEI Security Scanner, a security scanning tool designed to help users detect, investigate, and remove threats associated with this incident.
Download URL: https://www.aomeiget.com/download/sec/AOMEI_Security_Scanner.exe
Scan Your System with Security Software
We recommend first updating the security software currently installed on your computer and running an initial scan. If the scan does not provide a conclusive result, we recommend installing Malwarebytes Free from an official source and running a malware scan. Malwarebytes has stated that its software can detect the malicious files used in this attack.
How to Get Help
Once AOMEI has assessed which users may have been affected, we will proactively notify them and work with them to implement appropriate security measures. In the meantime, if you need assistance, please contact technical support through AOMEI’s official channels.
Dedicated contact for this incident: [email protected]
We can provide real-time email support as well as remote assistance. Please contact us if you need help, and we will respond as quickly as possible.
Finally, we thank GTIG (Mandiant) and ManageEngine (METAL) for discovering and analyzing this incident, and for their contributions to protecting the broader software ecosystem. This incident has driven an upgrade of AOMEI’s software security framework. By sharing the details, we also hope to help other software vendors understand this type of attack and prevent similar incidents.
AOMEI Security Team