Executive Summary
UNC7017 conducted a sophisticated software supply chain campaign targeting AOMEI Technology's update infrastructure. The threat actor utilized brief configuration-tampering windows, typically lasting only five to ten minutes, to redirect update requests toward malicious servers. This ephemeral nature allowed the campaign to evade traditional point-in-time security scanning.
The attack chain involves a multi-stage payload delivery, beginning with the CROSSROAD downloader and leading to the deployment of the SHINYROAD backdoor. Evidence suggests an infrastructure shift from cloud providers to dedicated vendor-themed domains and legitimate cloud storage to further mask malicious activity. The investigation was jointly conducted by Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab.
This campaign highlights the extreme risk of supply chain redirection. Organizations relying on third-party update clients are at risk of compromise if end-to-end cryptographic verification is not strictly enforced. The targeted timeframe for this activity spans from April through July 2026.