[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgXZ3nRlgYdQZkbFRvR2PDGPMjgx6qwQ4obPwWhffmg0":3},{"article":4,"iocs":49,"watch_terms":59,"solutions":60,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8821c658-83fe-418b-9ad6-eaeff81730f2","AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign","aomei-backupper-compromised-in-short-burst-supply-chain-campaign-9f7d9f","Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.","AOMEI Backupper, a popular backup software used by millions, was compromised multiple times between April and July in short-burst supply chain attacks. Threat actor UNC7017 tampered with update servers for brief periods, distributing the CrossRoad downloader and ShinyRoad backdoor. The campaign targeted opportunistic systems, affecting entities across various sectors and countries, including higher education, IT services, and telecommunications.","AOMEI Backupper users targeted by short-burst supply chain attacks distributing ShinyRoad backdoor.","https:\u002F\u002Fwww.securityweek.com\u002Faomei-backupper-compromised-in-short-burst-supply-chain-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F01\u002FSupply-Chain-Software-Attack.jpg","2026-10-20T13:51:01+00:00","2026-10-20T14:24:35.859955+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"AOMEI Backupper","product",{"name":21,"type":22},"UNC7017","threat_actor",{"name":24,"type":25},"AOMEI","vendor",{"name":27,"type":19},"Radmin Server",{"name":29,"type":30},"WebDAV","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,56],{"type":43,"value":51,"context":52},"ShinyRoad","Modular backdoor framework distributed in the campaign.",{"type":43,"value":54,"context":55},"CrossRoad","Downloader used to deliver ShinyRoad.",{"type":43,"value":57,"context":58},"Adaptix","Post-exploitation framework observed.",[24,18,27],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":92,"name":93,"problem":94,"products":95},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"slug":121,"name":122,"problem":123,"products":124},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[150,156],{"slug":151,"name":152,"logo_path":153,"roles":154},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[155],"reported_by",{"slug":157,"name":158,"logo_path":159,"roles":160},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png",[155],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"aomei-backupper-update-servers-hijacked-in-repeated-supply-chain-attacks","AOMEI Backupper Update Servers Hijacked in Repeated Supply Chain Attacks","Threat actor UNC7017 repeatedly compromised AOMEI Backupper's update infrastructure between April and July, using brief windows of access to push malicious payloads — the CrossRoad downloader and ShinyRoad backdoor — to unsuspecting users. The short-burst nature of the campaign was deliberately designed to evade detection, exploiting the implicit trust users place in software update mechanisms. This incident illustrates how popular utilities with large install bases make high-value targets for supply chain attacks, as a single upstream compromise can cascade to millions of endpoints. Organizations that lack software integrity verification and update-pipeline monitoring have no reliable way to distinguish legitimate updates from weaponized ones.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":174,"MITRE ATT&CK T1566: Phishing":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"CIS Control 17: Incident Response Management":177,"OWASP A06:2021 Vulnerable and Outdated Components":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180},"NIS2 mandates supply chain security measures for entities in critical sectors such as telecommunications and higher education — exactly the sectors targeted — requiring them to assess and manage risks arising from third-party software vendors.","While not phishing directly, the attacker leveraged a trusted delivery channel (software updates) as the initial access vector — analogous to the trust-exploitation technique family — highlighting the need to treat all external software delivery mechanisms with suspicion.","SI-2 requires organizations to verify the integrity of software obtained from external sources; applying this control to update pipelines would have detected the malicious payloads inserted by UNC7017.","A mature incident response capability with pre-defined playbooks for supply chain compromise would have enabled faster identification, containment, and remediation of the ShinyRoad backdoor across affected endpoints.","This risk highlights the danger of blindly trusting third-party components and their update mechanisms; organizations should validate component integrity and monitor for unexpected changes in supplier-distributed software.","Continuous monitoring of the software supply chain — including integrity checks on update servers and distributed packages — would have flagged the tampered AOMEI update binaries before widespread deployment.","This control requires organizations to assess and address vulnerabilities in software they use, including monitoring supplier security posture; applying it to AOMEI's update infrastructure would have prompted integrity controls on the update server."]