AOMEI Backupper hit by short-burst supply chain attack

Google Cloud and Mandiant detailed UNC7017's campaign against AOMEI Backupper: from April to July the update server was tampered with for 5–10 minutes at a time to deliver the CrossRoad downloader and ShinyRoad backdoor. Victims include universities, IT services and telecoms in 12 countries.

• Tampering windows lasted only 5–10 minutes before reverting to authentic files
• Attackers abused AOMEI's promotional content channel with no cryptographic checks
• Final payload was the modular ShinyRoad backdoor and Adaptix C2 framework
• AOMEI dismissed the June report and fixed the issue in late July