Google Threat Intelligence Group (GTIG) and Mandiant have analyzed a software supply chain attack targeting AOMEI Technology’s update infrastructure between April and July 2026. The attackers, tracked as UNC7017, repeatedly modified update server configurations for short periods of just five to ten minutes, which made the campaign difficult to detect through routine security checks.
The attack affected the update process for the AOMEI Backupper backup and recovery tool, and the AnyViewer remote desktop app.
During each attack window, UNC7017 altered two configuration files (down_html.ini and Notifycfg.ini) to redirect software clients to malicious ZIP archives hosted on attacker-controlled infrastructure. They then triggered local execution of downloaded files. The attackers also changed build version information and MD5 checksums to make the malicious packages appear valid to the update process.
The malware delivery chain included CROSSROAD, a downloader that checks the target environment and installs additional components, and SHINYROAD, a modular backdoor used for covert command-and-control (C&C) activity. CROSSROAD establishes persistence via a scheduled task, allowing SHINYROAD to run without implementing its own persistence mechanism.
The attackers also changed their delivery infrastructure throughout the campaign, moving between public cloud storage, dedicated lookalike domains and legitimate cloud services.
The campaign was first identified through collaboration with the ManageEngine Threat Analysis Lab (METAL), whose endpoint detection and response (EDR) telemetry detected suspicious activity across multiple customer environments in late May. Reported victims spanned IT services, telecommunications, higher education and related sectors across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States.