AOMEI Backupper, a widely used Windows backup and disk cloning software, experienced multiple brief supply chain compromises between April and July. During this period, attackers altered the software's update mechanism to distribute malware to users. The campaign involved tampering with the update server's settings to serve a malicious ZIP archive, impacting all systems that downloaded these compromised updates. The attacks were transient, with each tampering window lasting only five to ten minutes before reverting to legitimate versions. This strategy allowed the attackers to remain under the radar.

The threat actor, identified as UNC7017, targeted various sectors including higher education, IT services, and telecommunications in countries such as the United States, Australia, and India. The campaign involved the deployment of the CrossRoad dropper and the ShinyRoad backdoor, among other malicious payloads. Investigators from Google Cloud, Mandiant, and METAL identified these attacks as part of an evolving trend in supply chain threats, where attackers opt for short-lived configuration tampering over traditional code manipulation.

Despite initial dismissal from AOMEI Technology regarding the tampering reports, further notifications led the company to take corrective actions by late July. The incident underscores the need for heightened vigilance in monitoring software update mechanisms and securing the supply chain against such sophisticated and stealthy attacks.