Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026.
Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026.
The campaign delivered a multi-stage payload chain involving the newly tracked CROSSROAD downloader and SHINYROAD backdoor. The threat actor iteratively modified its tradecraft, pivoting its staging infrastructure from cloud providers to dedicated domains and legitimate cloud storage. This evolving staging setup makes it particularly challenging for defenders to establish effective infrastructure-based blocking or network controls. We attribute this activity to a threat cluster we are tracking as UNC7017.
Based on available telemetry, impacted organizations spanned diverse sectors, including IT services, telecommunications, higher education and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States. That said, because the campaign attempted to deliver malware to any system polling the update distribution servers during the threat actor’s tampering windows, victimology was opportunistic and likely extends more broadly than the organizations we directly identified.
This campaign was initially identified through collaborative research with the ManageEngine Threat Analysis Lab (METAL), part of Zoho Corporation, whose endpoint detection and response (EDR) telemetry first detected the activity in late May across multiple customer environments. We thank the METAL team for their proactive telemetry sharing and ongoing collaboration to help secure our mutual customer bases and the broader software ecosystem. Following this joint effort, GTIG notified potentially affected organizations and shared technical findings with AOMEI Technology. AOMEI reported that they took corrective action to secure their distribution servers. METAL’s analysis of this campaign is available in their blog.
In context
- Topic: Supply Chain y Logística — Cadena de suministro, distribución, inventarios y visibilidad.
- Source: Google Cloud Blog
- Published: 15/10/2026
Continue reading at the original source →
Excerpt published automatically by the site radar. The full text belongs to its publisher and is linked above.
Why it matters
Panama lives off this, so I read these stories differently: every movement in routes, ports or international trade is felt here before it is felt elsewhere. What is a business-section note in another country is a payroll conversation here.
My reading goes through visibility upstream. Almost every company knows who its supplier is; very few know who their supplier's supplier is. And it is there, at the second tier, that the surprises which stop a production line usually live.
What usually goes wrong
The frequent mistake is optimising each link separately. Procurement negotiates a better price, production adjusts batch sizes, logistics consolidates shipments, and each hits their target while the whole becomes more fragile. The sum of local efficiencies usually produces a chain that cannot take a hit.
What to watch
- How it hits transport costs and lead times, which move fast in this region.
- Where the concentration sits: one supplier, one route or one port with no replacement.
- How many days of operation inventory covers if that dependency is cut.
How I read this entry
What I would do is translate this into days of operation. Not into percentages or dollars first, but into how many days the business can keep shipping if this piece fails. Everyone at the table understands that number, and it orders priorities without argument.
This entry is an excerpt from the original source, selected by the site radar. The commentary above is the site's own and does not belong to the cited publisher.
Comments
No comments yet. Yours can be the first.
Living through this in your own team?
Open the chat and tell me how you're handling it. I'm interested in comparing notes.
