{
  "type": "bundle",
  "id": "bundle--258fd09f-a45c-5d90-86f3-eb771b497498",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--db65224d-6144-5117-80ee-a21685488e5c",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "org:df397384-1361-4257-aec2-c310d163ecc2",
      "name": "AOMEI Technology",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "inc:8ad4fdfd-f4d3-451a-9e3d-3b9e6e18d399",
      "name": "AOMEI update infrastructure compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ce2a71ed-2699-525e-81d6-ddd91048a05a",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "brh:83ba3f90-1a35-4de3-8de1-d3c39527f782",
      "name": "AOMEI update infrastructure compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b2b0cfb-419b-5381-819c-bee8c72c8785",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:10ae72f6-5c7c-473b-b286-9e360291dcc4",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--8017463e-11ef-5047-8007-10705ef812e8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:e787bedf-a2c9-45a6-b789-9843dde8364f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2df28719-4374-540e-8dcf-d341e251bf9b",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:a8851237-37e4-4d3f-895b-6b03866928e7",
      "relationship_type": "attributed-to",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-threat-actor--8952d0c7-439d-5a6c-80b6-71174973a041",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:3152bef1-2596-4d9d-af75-dd2db22d30a2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--489c7b95-da9c-549a-8e25-3054140e2b94",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:7eb2530f-84de-449c-8004-cff2be07a465",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--a17203ee-c80f-5f46-8d79-d14c1c54bc48",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:5a20312c-b113-4f9f-b540-89f6b558754d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f120da1-65bb-56d5-8d21-4fe35c7ed24b",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:ee847f52-c580-488c-9ce0-25d5872d8d44",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--9a8d49ee-da8c-583e-846c-c80e2bf5bd35",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:285ef7a9-0dae-444e-afe2-f809484fe5a8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ef25de2-354f-5526-8462-a4fb4633340f",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:39efd936-5985-4dbd-b9d5-dcc6f89e4401",
      "relationship_type": "used-product",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "software--54efdae0-c42c-58c9-8973-3f1de1ba3fd2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:b35e53fd-366e-4f1b-8de5-e2889858ac93",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa4325f7-dbf2-5891-8b8b-681d4f9725cf",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:4179fef9-7713-4ed2-9801-266325dafd0d",
      "relationship_type": "affected-organization",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "identity--db65224d-6144-5117-80ee-a21685488e5c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:80eaba65-07f4-4525-879b-5e5472c8212d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac215fe9-5f15-5798-8586-8e7585ebdec8",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:79951aa1-b3ee-4198-9201-c2bdb21b579b",
      "relationship_type": "used-malware",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-malware--e17ff598-f8c7-5cbb-86bb-e77c3e9308d8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:366e8a82-f50e-4ee7-95b1-a487d0b964e9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c048a99f-1d3c-5bb2-8973-392807b41890",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:0d10b278-904f-48e0-bf32-8a4279c05a07",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--438b9514-8efd-518d-811c-b56c15b8af29",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:9ffcbee5-78b3-4084-b028-151b67697287",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb29ec6d-4b6d-589f-8bfa-2b7009066e90",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:78bfa0f1-6631-4395-92b6-37b44aa87b57",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--92b75178-a830-51c8-89c1-88b11004d27c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:2f07f141-944b-4951-95fc-b19f865da39e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbd206ef-da88-57b8-8534-b3410ab276ba",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:53578f80-f53f-4732-b060-281f25594c5a",
      "relationship_type": "used-malware",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-malware--8b891a75-2414-54b5-82e2-14fb9e40debe",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:cd92e4bc-19e7-4a59-8916-9d4bdf9d3496",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcd44b2e-c96c-5bff-8a3a-a43833c28910",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:81595a9a-b086-43a1-b8cf-153f174bf75b",
      "relationship_type": "resulted-in",
      "source_ref": "incident--9a57dc32-f063-59a4-812a-5521ab224301",
      "target_ref": "x-ally-event--8ba1aacf-8574-5559-8989-54641a5f1cf6",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:aad72fe8-2a3b-4df6-bef4-9e829aa7a47b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--54efdae0-c42c-58c9-8973-3f1de1ba3fd2",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "prd:6e81c3e4-5bdb-482f-8726-5ce25d3f79f4",
      "name": "AOMEI Backupper"
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1baa9f31-0308-54a2-89f0-947b7a1c7a31",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:878339e9-54f1-4062-baf1-f876720e7b12",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1053/005/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1d59ec13-c480-5c18-86d2-d7711e7bc8d3",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:7d4cf231-3c3b-459c-b8a2-52d295825f4e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:357583b5-2da2-47d7-ba85-cb2c7fd6b570",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4909c41b-aa60-555f-84cd-b620f2657aa0",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:0824e4b3-dbb2-4055-986f-b069020c7c59",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:cff58dc7-6052-423d-a525-e38915daf92f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "METAL detected Backupper installing a remote-administration payload on two unrelated customer endpoints on May 28."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4f2665aa-5fdd-515f-8115-4235732be13d",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:e2f317da-a6ae-4d1b-9b64-a8e33298f2d4",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1195/002/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5730c9f0-0917-575d-8bfe-127f9637f85a",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:2e1a81d3-5a0c-4998-84a7-28ae04c22173",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:969a3d62-c2f1-4777-bb88-b18943b80635",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-06-07"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5e7fd46f-44d9-5e31-8118-d3b41921c28a",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:3e57a6c1-844e-48e2-be20-8e712a9b108c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:76296665-4de9-4611-acd5-82557607fc6c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The payload established a scheduled task to maintain execution of the backdoor components."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--695cb95a-0096-50a3-86e1-de6aa44e50d5",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:b74b2870-bb45-4a09-8e9c-b3227b5378ab",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:686b397e-a734-4a39-88bf-eee879337917",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Confirmed server-tampering windows were May 28, July 16 and July 20, lasting ten, six and five minutes respectively."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--73e787f3-a7a7-52f0-844d-a432ed2d1888",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:c22091d0-7cd5-4ec9-b31c-28807bedefbf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:3915f627-cb89-427c-9da2-c6eb60cf1518",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-07-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--83c0af50-e010-5213-8158-f4a621b71af7",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:9917913b-4209-4b21-b4f7-170257dbc1c7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:2eefe828-0b0c-4423-8c4f-b62229b8996d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-07-20"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--98335f99-ca7f-5473-84d1-5905d4cd56c3",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:baa1199a-4056-44fc-8ea7-2b0ffe063d9e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:09190993-8b56-4817-957f-440ba6d4f916",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "METAL notified AOMEI June 7 and had not independently verified containment when it published October 16."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b17d0a18-90c6-5f06-8f33-ba2f8503ddb5",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:b8f6b36b-4090-4fa6-8319-07f6fbf08371",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:91b5d0c6-dc79-49f8-a6ea-e0b23f6669e2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Mandiant notified AOMEI July 17; AOMEI reported corrective action July 29. Server-side repair does not remove earlier endpoint infections."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b243e04e-354f-5f54-80e0-d2f9bbf47bb8",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:3991f1c1-07ac-487f-a534-652e8c6d5803",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:80127114-1a07-4bce-af92-969552ec2d64",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-07-29"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b5520724-c452-5779-8edb-ff11b55158c0",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:a6428031-0b5c-4b1a-afb8-49eb67de6680",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:f06bebbe-a57f-497b-bc43-b83dd2564289",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Google reported affected organizations across eleven countries, without a complete victim count."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d457a8a1-2044-5d7c-89cc-1166ea9079f9",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:c747022e-3c28-438a-84d1-6c90a3ef09d2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group / Mandiant",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering",
          "external_id": "cit:c4181413-0da4-413a-adfb-11a1c506e706",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f8cd6b71b143422180e345e236f985caf545c488ef8119c6f9e8115260ce9c4c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Investigators captured brief changes to AOMEI update configurations that redirected clients to malicious content."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e553e58d-0460-5fb5-85de-b43d3b0cf855",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:585cdd4b-67de-4ba3-b813-9822d0f4d0cb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:682828cf-157f-4106-a346-2a229eb04511",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-05-28"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f8892783-b432-554a-875f-0b683d57af7d",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "clm:b29cb8b7-9b58-4729-ad69-d451479be74d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ManageEngine Threat Analysis Lab",
          "url": "https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html",
          "external_id": "cit:2b762e0f-ef4a-4884-8784-27ab2bac2974",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9113d1daaca48d83dbcb2d5d35da2641dd33e97dbe9dbf4bdb68a91896894640"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "METAL found unauthenticated update configuration files with the archive checksum inside the same configuration that specified its download."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--438b9514-8efd-518d-811c-b56c15b8af29",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:c8cecb80-d537-451c-814f-ba6153b141e1",
      "name": "Google published its investigation"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--8017463e-11ef-5047-8007-10705ef812e8",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:dd86a76e-6fd0-4018-97b5-242b6194e9da",
      "name": "METAL observed the endpoint execution chain"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--8ba1aacf-8574-5559-8989-54641a5f1cf6",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:d19c268d-24d9-4910-8d1e-5348af0d7f9c",
      "name": "Investigators captured transient tampering"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--92b75178-a830-51c8-89c1-88b11004d27c",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:a263b946-3b57-4671-a488-519053957b6d",
      "name": "Vendor reported corrective action to Mandiant"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--9a8d49ee-da8c-583e-846c-c80e2bf5bd35",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:5fa9c8bc-6d50-4c70-b397-9fef6907db9f",
      "name": "Another short tampering window observed"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--a17203ee-c80f-5f46-8d79-d14c1c54bc48",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "evt:07284950-84dc-4fcb-a1d4-481ffe9e4e8f",
      "name": "METAL notified AOMEI"
    },
    {
      "type": "x-ally-malware",
      "spec_version": "2.1",
      "id": "x-ally-malware--8b891a75-2414-54b5-82e2-14fb9e40debe",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "mal:7e6286af-5c83-4ad8-a5a7-b7560d772f0e",
      "name": "CROSSROAD"
    },
    {
      "type": "x-ally-malware",
      "spec_version": "2.1",
      "id": "x-ally-malware--e17ff598-f8c7-5cbb-86bb-e77c3e9308d8",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "mal:e777c6b2-174b-47a2-861f-9e470f2308ef",
      "name": "SHINYROAD"
    },
    {
      "type": "x-ally-threat-actor",
      "spec_version": "2.1",
      "id": "x-ally-threat-actor--8952d0c7-439d-5a6c-80b6-71174973a041",
      "created": "2026-10-19T14:11:10.663523+00:00",
      "modified": "2026-10-19T14:11:10.663523+00:00",
      "x_ally_original_id": "act:52b23360-1898-40af-a430-bfaf4d3d8cf5",
      "name": "UNC7017"
    }
  ]
}