AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Threat actor UNC7017 repeatedly compromised AOMEI Backupper's update infrastructure between April and July, using brief windows of access to push malicious payloads — the CrossRoad downloader and ShinyRoad backdoor — to unsuspecting users. The short-burst nature of the campaign was deliberately designed to evade detection, exploiting the implicit trust users place in software update mechanisms. This incident illustrates how popular utilities with large install bases make high-value targets for supply chain attacks, as a single upstream compromise can cascade to millions of endpoints. Organizations that lack software integrity verification and update-pipeline monitoring have no reliable way to distinguish legitimate updates from weaponized ones.