Investigating Ephemeral Supply Chain Tampering
A threat actor compromised AOMEI Technology’s update servers in 2026 using brief, five-to-ten-minute configuration changes to deliver malware via trojanized updates, evading detection and targeting diverse sectors globally.
Google Threat Intelligence Group and Mandiant uncovered a software supply chain attack on AOMEI Technology’s update infrastructure between April and July 2026. The threat actor, tracked as UNC7017, repeatedly altered server configurations for only five to ten minutes at a time, redirecting update downloads to malicious ZIP packages before reverting to legitimate files. This ephemeral tampering evaded traditional detection methods that rely on static file analysis or persistent server modifications.
The campaign delivered a multi-stage payload chain starting with the newly identified CROSSROAD downloader, which validated the environment and staged secondary components. CROSSROAD then deployed SHINYROAD, a modular backdoor framework delivered via trojanized administration utilities to establish covert command and control. The threat actor iteratively shifted its staging infrastructure from cloud providers to dedicated domains and legitimate cloud storage to complicate defensive blocking efforts.
Impacted organizations spanned IT services, telecommunications, higher education, and related entities across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. Victimology was opportunistic, as any system polling the update servers during the tampering windows could receive malware, likely extending beyond identified victims. The campaign was initially detected through endpoint detection and response telemetry from ManageEngine Threat Analysis Lab (METAL) in late May 2026.
Following the discovery, Google notified potentially affected organizations and shared findings with AOMEI Technology, which reported securing its distribution servers. The threat actor exploited AOMEI’s legitimate update and notification workflows by modifying configuration files to force immediate execution of malware. Systems checking for updates outside the tampering windows received clean files, while those polling during active windows downloaded and executed malicious payloads.