UNC7017 AOMEI-themed staging: storage-data.com, OSS/GCS buckets, C2 IPs

Suraj A@cytech

•updated 4 days ago•0•0•1

Detects network connections associated with UNC7017 AOMEI supply-chain staging and command-and-control (C2) infrastructure, including lookalike staging domains, Alibaba OSS bucket hosts, GCS bucket paths containing 'aomeiupdate', and known C2 IP addresses. Non-browser processes interacting with the cloud storage hosts are flagged to reduce noise.