UNC7017 Ephemeral Supply Chain Tampering Campaign

Between April and July 2026, the threat actor UNC7017 targeted AOMEI Technology's update infrastructure to conduct a novel software supply chain compromise. The campaign was characterized by 'short-burst' tampering windows, where malicious configuration files (`down_html.ini` and `Notifycfg.ini`) were active for only five to ten minutes before being reverted to authentic versions. This ephemeral approach successfully evaded traditional automated scanning and point-in-time triage, making detection exceptionally difficult for automated systems.

Technical analysis revealed a multi-stage infection chain. The initial stage involved redirecting AOMEI clients to download a weaponized ZIP archive containing the CROSSROAD downloader. CROSSROAD performed environment validation—including a China-based geolocation check—and deployed the SHINYROAD backdoor. The campaign also featured the use of the Adaptix C2 framework and secondary credential harvesting vectors via WebDAV NTLM coercion. Affected organizations spanned global sectors, including telecommunications, IT services, and higher education.

This activity highlights a shift in supply chain tradecraft, moving away from persistent source code modification toward ephemeral distribution-layer tampering. Organizations using AOMEI software (Backupper or AnyViewer) are advised that server-side remediation by the vendor does not disinfect endpoints that were compromised during the active tampering windows. Immediate retrospective hunting for persistent artifacts like scheduled tasks and unsigned DLLs is required.