As cited
Copy frozen at (site build).
threat intel
Investigating Ephemeral Supply Chain Tampering
Google Threat Intelligence Group and Mandiant discovered a sophisticated supply chain attack on AOMEI Technology's update infrastructure conducted between April and July 2026 by the threat actor UNC7017. The attacker modified AOMEI's remote configuration files for only 5 to 10 minutes at a time, redirecting update downloads to malicious payloads while evading detection. The campaign delivered custom malware including the CROSSROAD downloader and SHINYROAD backdoor, targeting organizations across IT services, telecommunications, higher education, and other sectors in multiple countries.
Why it matters: Organizations running AOMEI Backupper or AnyViewer software may be compromised even after the vendor applied server-side fixes, because endpoints that downloaded during the brief tampering windows retain persistent scheduled tasks and backdoors; immediate endpoint hunting using provided indicators is essential to identify and remediate infected systems.
- Source published
- First seen by Cybersecurity Tracker