Act
active
UNC7017 Uses Ephemeral Update Tampering in AOMEI Supply Chain Attack
- Engineer — Act: If AOMEI backup/disk utilities are deployed in your environment, audit endpoints and build systems for CROSSROAD downloader or SHINYROAD backdoor indicators; the 5–10 minute tampering windows mean file-integrity scans at rest may have missed the delivery.
- SOC/IR — Act: Hunt for CROSSROAD and SHINYROAD IOCs on hosts that could have fetched AOMEI updates between April and July 2026; standard hash-based detection likely missed the ephemeral delivery window, so focus on behavioral indicators (unusual parent-child process chains post-update, unexpected staging domain connections).
- Leader — Act: Confirm whether AOMEI software is in use anywhere in your environment and request Mandiant’s full IOC set to verify exposure; the novel evasion technique (auto-reverting tampering windows) is a systemic supply chain risk worth briefing leadership on as evidence that static compliance checks alone are insufficient.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.