Investigating Ephemeral Supply Chain Tampering

    Monday, October 19, 2026 In: Threat Research Print

    Date: 10/19/2026

    Severity: High

    Summary

    Threat actor UNC7017 conducted a software supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026, using brief configuration-tampering windows lasting just 5–10 minutes to evade traditional detection. Systems checking for updates during these windows were redirected to malicious ZIP packages containing CROSSROAD, a downloader that validates the environment and stages additional payloads, including SHINYROAD, a modular backdoor that uses scheduled tasks for persistence and covert command-and-control. The campaign affected organizations across multiple sectors and countries, including India, Australia, and the United States, demonstrating how temporary update-server manipulation can compromise software supply chains while avoiding routine security checks.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    promotion.storage-data.com

    aomei.storage-data.com

    storage-data.com

    serv.oss-cn-hongkong.aliyuncs.com

    https://promotion.storage-data.com/download/abpopup/upgrade-now.zip

    https://promotion.storage-data[.]com/config/component.zip

    https://promotion.storage-data.com/config/whitelist.ini

    https://promotion.storage-data.com/config/en.zip

    https://storage.googleapis.com/aomeiupdate/upgrade-now.zip

    https://storage.googleapis.com/aomeiupdate/component.zip

    \\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html

    IP Address

    8.210.84.56

    8.218.65.184

    47.239.60.117

    96.126.191.98

    Hash

    6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7

    11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad

    9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450

    b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21

    9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba

    d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464

    8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8

    5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e

    4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b

    4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431

    d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c

    14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591

    8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4

    7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d

    2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b

    dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951

    d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd

    924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6

    d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934

    286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8

    f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection        

    Detection Query 1 :

    domainname like "https://promotion.storage-data.com/config/en.zip" or url like "https://promotion.storage-data.com/config/en.zip" or siteurl like "https://promotion.storage-data.com/config/en.zip" or domainname like "https://promotion.storage-data.com/config/whitelist.ini" or url like "https://promotion.storage-data.com/config/whitelist.ini" or siteurl like "https://promotion.storage-data.com/config/whitelist.ini" or domainname like "aomei.storage-data.com" or url like "aomei.storage-data.com" or siteurl like "aomei.storage-data.com" or domainname like "https://storage.googleapis.com/aomeiupdate/component.zip" or url like "https://storage.googleapis.com/aomeiupdate/component.zip" or siteurl like "https://storage.googleapis.com/aomeiupdate/component.zip" or domainname like "promotion.storage-data.com" or url like "promotion.storage-data.com" or siteurl like "promotion.storage-data.com" or domainname like "https://storage.googleapis.com/aomeiupdate/upgrade-now.zip" or url like "https://storage.googleapis.com/aomeiupdate/upgrade-now.zip" or siteurl like "https://storage.googleapis.com/aomeiupdate/upgrade-now.zip" or domainname like "https://promotion.storage-data.com/download/abpopup/upgrade-now.zip" or url like "https://promotion.storage-data.com/download/abpopup/upgrade-now.zip" or siteurl like "https://promotion.storage-data.com/download/abpopup/upgrade-now.zip" or domainname like "storage-data.com" or url like "storage-data.com" or siteurl like "storage-data.com" or domainname like "serv.oss-cn-hongkong.aliyuncs.com" or siteurl like "serv.oss-cn-hongkong.aliyuncs.com" or url like "serv.oss-cn-hongkong.aliyuncs.com" or domainname like "https://promotion.storage-data.com/config/component.zip" or siteurl like "https://promotion.storage-data.com/config/component.zip" or url like "https://promotion.storage-data.com/config/component.zip" or domainname like "\\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html" or siteurl like "\\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html" or url like "\\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html"

    Detection Query 2 :

    dstipaddress IN ("96.126.191.98","8.210.84.56","8.218.65.184","47.239.60.117") or srcipaddress IN ("96.126.191.98","8.210.84.56","8.218.65.184","47.239.60.117")

    Detection Query 3 :

    sha256hash IN ("11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad","d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd","8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4","2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b","dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951","5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e","8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8","4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b","6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7","9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450","b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21","9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba","d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464","4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431","d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c","14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591","7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d","924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6","d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934","286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8","f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4")

    Reference:   

    AOMEI Supply Chain Compromise                                                          


    Tags

    MalwareThreat ActorSupply chain attackInformation TechnologyBackdoorIndiaAustraliaUnited States

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.