UNC7017 Compromises AOMEI Backupper Update Channel in Short-Burst Supply Chain Attacks Delivering CrossRoad and ShinyRoad
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…