The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoNews
Investigating Ephemeral Supply Chain Tampering
- Published
- Record updated
Summary
Google Threat Intelligence Group and Mandiant investigated a supply chain compromise targeting AOMEI Technology's update infrastructure between April and July 2026. The threat actor, tracked as UNC7017, repeatedly tampered with AOMEI origin server configurations for five to ten minutes at a time, delivering a multi-stage payload chain involving the CROSSROAD downloader and SHINYROAD backdoor.
Mitigation
AOMEI reported that they took corrective action to secure their distribution servers.