Hackers Tampered With AOMEI Software Updates in Brief Bursts to Dodge Detection

Google Threat Intelligence Group (GTIG) and Mandiant have detailed a software supply chain compromise targeting the update infrastructure of AOMEI Technology between April 2026 and July 2026. The attacker repeatedly tampered with configuration on AOMEI origin servers, but each change lasted only five to ten minutes before the servers reverted to authentic versions. GTIG says this is the first time it has seen a supply chain compromise use such short windows, which helps the activity evade point-in-time checks and automated file scanning.

The campaign delivered a multi-stage chain of malware, including a newly tracked downloader called CROSSROAD and a backdoor called SHINYROAD. The attacker, tracked as UNC7017, changed its approach over time, moving its staging infrastructure from cloud providers to dedicated domains and legitimate cloud storage. This makes blocking based on infrastructure harder for defenders.

Affected organisations included IT services, telecommunications and higher education, across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. Because any system checking for updates during a tampering window could receive malware, the real reach is likely wider. The activity was first spotted in late May by the ManageEngine Threat Analysis Lab through its endpoint detection telemetry. GTIG notified potentially affected organisations and shared findings with AOMEI, which reported it took corrective action to secure its distribution servers.