On October 16, 2026, Google Threat Intelligence Group and Mandiant disclosed the UNC7017 campaign: attackers briefly tampered with AOMEI Backupper's own update servers — in 5–10-minute windows, between May and July 2026 — and anyone whose client checked for updates inside a window downloaded a backdoored updater. Everyone else saw nothing. No phishing email, no fake site, no shady download: the malware came from the real vendor, through the real update channel, during a window so short it was gone before anyone looked. This is the tamper-window attack — and it works against every product that phones home for updates. This check grades your polling cadence against it: do you poll inside a tamper window? Free, no signup.
The scary arithmetic: if your fleet of 500 machines all polls at boot every morning, the chance that someone lands inside a 10-minute window is effectively 100%.
Answer for the software that auto-updates on your machines. "Yes" is the risky answer.
This self-assessment is informational. It reflects the October 16, 2026 UNC7017 disclosure and standard update-channel hygiene — it is not a security audit.
UNC7017 is the threat-actor designation for a campaign disclosed October 16, 2026 by Google Threat Intelligence Group and Mandiant. From May to July 2026, the attackers briefly tampered with AOMEI Backupper's own update servers in 5–10-minute windows; users whose clients checked for updates inside a window downloaded a backdoored updater instead of the legitimate one.
UNC7017 is the threat-actor designation for a campaign disclosed October 16, 2026 by Google Threat Intelligence Group and Mandiant. From May to July 2026, the attackers briefly tampered with AOMEI Backupper's own update servers in 5–10-minute windows; users whose clients checked for updates inside a window downloaded a backdoored updater instead of the legitimate one.
AOMEI's own update servers were tampered with during the UNC7017 campaign — but only in brief 5–10-minute windows between May and July 2026, according to Google Threat Intelligence Group and Mandiant (disclosed Oct 16, 2026). Clients polling for updates inside a window received a backdoored updater. AOMEI itself, and clients that updated outside the windows, were not affected.
A tamper window attack is a supply-chain technique where attackers compromise a legitimate vendor's update or distribution infrastructure for a very short time — here 5–10 minutes — then remove the malicious content before anyone notices. Anyone who checks for updates inside that window receives malware from a server they trust; everyone else sees nothing wrong. It defeats reputation-based trust because the malicious file comes from the real, signed update channel.
The campaign ran May–July 2026, so the key question is whether your AOMEI Backupper checked for updates or downloaded one in that period. Look for update activity in those months, verify the digital signature of installed components against AOMEI's published certificates, and run a current antivirus/EDR scan. If in doubt, reinstall from a fresh download obtained directly from the vendor and verify the signature.
Yes — disabling auto-updates leaves you exposed to the far larger set of known, unpatched vulnerabilities. The UNC7017 lesson is to harden the update channel instead: verify code signatures, stage updates on a pilot group first, monitor update traffic for anomalies, and keep backups offline. This page's checker grades your current update hygiene against the tamper-window threat.
Informational only: this page reflects the published October 16, 2026 UNC7017 disclosure by Google Threat Intelligence Group and Mandiant. It is not a forensic investigation or legal advice. Confirm details against the published reports before acting.
Filed under Cybersecurity News by Ingenious AI — see the related checks above for more in this series.