← Saturday, October 17, 2026SecurityDeep dive

Supply-chain attackers tampered with update servers in five-to-ten-minute windows

cloud.google.com by Mandiant, Google Threat Intelligence Group 23 min read Editor score 8/10

Investigators found repeated brief changes to AOMEI update infrastructure that reverted to authentic files after five to ten minutes, delivering a multi-stage payload. The short windows show why point-in-time scans can miss supply-chain compromises.

What: A campaign targeted AOMEI Technology's update infrastructure between April and July 2026.
How: Attackers tampered with origin-server configurations for five to ten minutes, then restored authentic versions; the campaign delivered CROSSROAD and SHINYROAD.
Why it matters: Brief tampering windows evaded point-in-time triage and automated file scanning, so update-integrity monitoring must account for changes that quickly revert.

AOMEI update services poll configuration and use it to locate the update package. Sketched from the article's own text.

Read on cloud.google.com →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.