AOMEI update-path response thresholds

The October 20, 2026 Roundtable discussion addressed an AOMEI Backupper update-infrastructure compromise attributed in the campaign handoff to UNC7017 and a reported May–July tampering window.

Responders must make current isolation and rebuilding decisions even though the packet lacks a primary campaign source and may not contain the complete campaign window. Installed version and absent alerts do not answer whether a host executed the payload; retained host-specific evidence does.

Delaying classification risks treating missing process, file, module-load, scheduled-task, or network telemetry as negative evidence, while immediate evidence-based triage separates metadata-only exposure from probable impact and confirmed payload activity.

Three AOMEI Backupper host populations require distinct treatment.

First, hosts that contacted the reportedly compromised update path during the reported May–July window or retrieved modified down_html.ini, but show no archive on disk, are exposed and require telemetry review.

Second, hosts that retrieved or extracted upgrade-now.zip or unsigned upgrade-now.exe while process, file, or module-load evidence is incomplete are probably affected and cannot be cleared from absent alerts.

Third, hosts showing loader execution, persistence, command-and-control, or credential access require isolation, rebuilding, and credential response.

SOC analysts, endpoint responders, AOMEI Backupper administrators, and owners deciding whether a host may remain in service must apply these evidence tiers. No affected AOMEI Backupper version range is supplied, so installed version alone cannot narrow or clear the population.

Support — The supply-chain analyst’s AOMEI Backupper host-ranking analysis distinguishes metadata contact from archive retrieval and execution, and states that incomplete telemetry must not be treated as proof of safety.

Support — The threat hunter’s no-rebuild test identifies the continuous endpoint, filesystem, module-load, scheduled-task, and network evidence needed to exclude upgrade-now.exe, FamItrfc.exe, BlkScrDl.dll, RuntimeComponent.dll, RadminComponentRuntime, and NitroRuntime.

Support — The moderator’s synthesis adopts execution evidence, rather than installed version, as the response criterion and preserves the exposure, probable-impact, and confirmed-compromise tiers.

Support — The evidence audit finds these three analyses aligned on conservative escalation for telemetry gaps and on isolation, rebuilding, and credential response after payload activity.

Evidence gap — A separate audit finds no primary vendor or research source in the packet for the May–July period or campaign-specific behaviors, so those facts remain attributed rather than independently established here.

The supply-chain analyst proposed classifying AOMEI Backupper hosts by execution evidence rather than installed version: update-path contact or retrieval of down_html.ini indicates exposure, while retrieval or extraction of upgrade-now.zip or unsigned upgrade-now.exe with incomplete telemetry indicates probable impact.

The threat hunter then defined the evidence required to avoid rebuilding: continuous host-specific telemetry from before retrieval through containment must exclude execution of upgrade-now.exe and FamItrfc.exe, archive extraction, loads of BlkScrDl.dll and RuntimeComponent.dll, the RadminComponentRuntime and NitroRuntime scheduled tasks, and related outbound communication.

The moderator resolved the central uncertainty by adopting those tiers and rejecting missing telemetry as proof that execution did not occur.

The evidence audit found strong support for this operational framework but separately found that the reported May–July period and campaign behaviors lack a primary vendor or research citation.

The boundary assessment therefore limited campaign-specific statements to attributed or precautionary language. A search found no prior decision record covering these thresholds, and the arbiter selected a new operational decision.