Attackers compromised AOMEI Technology’s software distribution infrastructure and used brief tampering windows to deliver malware through a trusted update mechanism, according to new research from Google and Mandiant.
Google Threat Intelligence Group and Mandiant tracked the activity as UNC7017. Researchers observed malicious changes lasting only five to ten minutes between April and July 2026. Systems checking for updates during those windows received attacker-controlled instructions, while later inspections saw legitimate files.
The campaign redirected AOMEI clients to a weaponized archive containing the CROSSROAD downloader. That component established persistence and deployed SHINYROAD, a modular backdoor. Researchers said the attackers also abused legitimate administration tools and changed infrastructure as the campaign evolved.
The short-lived modifications created a significant forensic challenge. A security team investigating after the event could visit the same update location and find only clean content, increasing the risk that an alert would be dismissed as a false positive.
AOMEI told the researchers it had taken corrective action to secure its distribution servers. That server-side response does not remove malware already installed on customer endpoints.
Organizations that ran AOMEI software during the April through July exposure period should conduct retrospective endpoint and network hunts using the published indicators. Defenders should focus on suspicious child processes from updater services, unexpected scheduled tasks and connections to infrastructure identified in the research.
The incident shows why signed software alone is insufficient when an update client accepts unsigned configuration changes or downloads content from destinations that are not tightly restricted.