Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
Google Threat Intelligence Group and Mandiant investigated UNC7017 tampering with AOMEI Technology update infrastructure from April through July 2026. The actor altered down_html.ini and Notifycfg.ini for only five to ten minutes at a time, redirecting AOMEI Backupper and AnyViewer clients to a malicious ZIP, then restoring legitimate files. The package deployed the CROSSROAD downloader, which used scheduled tasks to install the modular SHINYROAD backdoor. Impacted organizations included IT services, telecommunications, and higher education across at least 11 countries, and victim selection was opportunistic. AOMEI said it secured the distribution servers after notification.