UNC7017 Tampered AOMEI Backupper Update Servers in Five-to-Ten Minute Windows April-July
Short-burst tampering of AOMEI Backupper servers by UNC7017 exposed unauthenticated update and promotional channels, compromising entities in eleven countries with CrossRoad and ShinyRoad. The incidents reveal systemic weaknesses in software supply-chain integrity that extend beyond single vendors to any product relying on unsigned remote content delivery.
AOMEI’s 186 million users and the absence of signed configuration files create a repeatable attack surface for any actor able to reach the update host briefly. Similar unauthenticated channels exist in other backup and deployment tools; defenders should treat promotional and update paths as high-risk until cryptographic enforcement is verified in procurement and configuration audits.
Mandiant: UNC7017 or a copycat will repeat the five-minute tampering tactic against at least one additional backup vendor within 120 days.
Sources (2)
- [1]Primary Source(https://www.securityweek.com/aomei-backupper-compromised-in-short-burst-supply-chain-campaign/)
- [2]Supporting Source(https://cloud.google.com/blog/topics/threat-intelligence)