Ephemeral Supply Chain Tampering Used to Deploy SHINYROAD Backdoor
Mandiant uncovered a sophisticated supply chain attack targeting AOMEI Technology's update infrastructure, employing brief, repeated configuration tampering to deploy the SHINYROAD backdoor.
Mandiant, in collaboration with the Google Threat Intelligence Group (GTIG) and the ManageEngine Threat Analysis Lab (METAL), has detailed a novel software supply chain compromise campaign that targeted the update infrastructure of AOMEI Technology between April and July 2026. The threat actor, tracked as UNC7017, employed a unique tactic of short-burst configuration tampering against AOMEI's origin servers. These malicious modifications were active for mere minutes—typically five to ten—before being reverted to legitimate versions, a strategy designed to evade traditional detection methods that rely on point-in-time analysis and automated file scanning.
The campaign successfully delivered a multi-stage payload chain, initiating with the newly identified CROSSROAD downloader and culminating in the deployment of the SHINYROAD backdoor. UNC7017 demonstrated adaptability by iteratively shifting its staging infrastructure, moving from cloud providers to dedicated domains and then to legitimate cloud storage services. This evolving infrastructure footprint presents a significant challenge for defenders attempting to implement effective blocking or network controls.
The compromised software, AOMEI Backupper and AnyViewer, is used for data backup, disk cloning, disaster recovery, and remote desktop access. Users of these products rely on the ABMarket update flow and associated background services (Backupper.exe and ABNotify.exe) which periodically poll remote endpoints for update notifications. The attackers exploited this mechanism by tampering with two key configuration files: down_html.ini, which dictates update package downloads, and Notifycfg.ini, which controls notification pop-ups and command execution.
During the brief tampering windows, UNC7017 modified these configuration files on AOMEI's servers. This redirection caused client applications to download a malicious ZIP package from attacker-controlled servers instead of official updates. Simultaneously, the Notifycfg.ini file was altered to abuse the software's automatic notification service, forcing the system to execute the downloaded malware locally. Any system checking for updates during these narrow windows would inadvertently download and execute the trojanized update.
The weaponized ZIP archive contained CROSSROAD, an initial downloader responsible for validating the environment and staging secondary components. Once deployed, CROSSROAD established persistence via scheduled tasks to deploy SHINYROAD, a modular backdoor framework. SHINYROAD was delivered through trojanized administration utilities, enabling covert command and control operations.
A defining characteristic of UNC7017's operational security is its reliance on these ephemeral, time-compressed server modifications. Observed tampering windows were exceptionally short: a 10-minute window on May 28th (05:40 – 05:50 UTC), a 6-minute window on July 16th (08:33 – 08:39 UTC), and a 5-minute window on July 20th (10:35 – 10:40 UTC). At the conclusion of each window, UNC7017 meticulously reverted both configuration files to their legitimate contents, minimizing their digital footprint.
The campaign's impact was widespread, affecting organizations across diverse sectors including IT services, telecommunications, and higher education in numerous countries. Given the opportunistic nature of the attack—targeting any system polling for updates during the active windows—the victimology is likely broader than initially identified. The initial detection was facilitated by METAL's EDR telemetry, leading to collaborative research and notification to AOMEI Technology, which subsequently secured its distribution servers.
This campaign highlights a concerning evolution in supply chain attack methodologies, demonstrating how threat actors can leverage brief, precisely timed intrusions to bypass traditional security measures. The ephemeral nature of the tampering and the adaptive infrastructure employed by UNC7017 underscore the need for more dynamic and continuous monitoring strategies to detect and mitigate such sophisticated threats.