The Attack: Compromised Updates Delivered Malware for Months
UNC7017 executed a sophisticated supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026. The threat actor used brief configuration-tampering windows — lasting only five to ten minutes — to redirect customer update requests toward malicious servers. This ephemeral approach helped evade traditional point-in-time scanning and signature-based detection.
The attack delivered a multi-stage payload chain: first the CROSSROAD downloader, then the SHINYROAD backdoor. Because the malicious files arrived through AOMEI’s legitimate update mechanism, traditional security controls treated them as trusted software. Organizations had no reason to suspect their backup and disk imaging software was delivering malware.
Mandiant and ManageEngine researchers detected the campaign through EDR telemetry, but only after the malware had already landed on customer systems. By that point, the backdoor was installed and the attackers had established persistence.
Why Traditional Controls Failed
Supply chain attacks succeed because they bypass perimeter defenses entirely. The malware doesn’t arrive in a phishing email or through an exploit — it comes from a vendor the organization explicitly trusts. Antivirus software struggles with these attacks because the delivery mechanism is legitimate, and the malware variants are often zero-day payloads with no existing signatures.
The AOMEI compromise highlights a fundamental problem: organizations have almost no visibility into what their software updaters are actually writing to disk. When AOMEI’s update client says “I need to write an executable file,” Windows allows it. There’s no policy layer between the trusted updater and the file system.
How FileSure Would Have Blocked It
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts every file operation before it completes. When the compromised AOMEI updater attempted to write the CROSSROAD downloader executable to disk, FileSure would have intercepted that write operation and evaluated it against the organization’s file access policy.
Here’s a specific rule configuration that would have stopped this attack:
Block Unauthorized Executable Writes by Update Processes
- File name filter:
*.exe;*.dll;*.bat;*.ps1;*.vbs - Program name filter: Whitelist only authorized update mechanisms by full path (e.g.,
C:\Program Files\Windows Update\wuauclt.exe), or use a blacklist to block all other programs from writing executables to system directories - Operations: Write, Create
- Drive type: Hard drives
- Result: Only explicitly authorized programs can write executable files to local drives. The compromised AOMEI updater — even though it’s a legitimate vendor application — would be blocked from writing the CROSSROAD payload unless it was specifically on the authorized list.
The key insight: even if the updater itself is compromised, it still has to write a file to disk. FileSure intercepts that write operation at the kernel level, before the file lands. If the policy says “this program cannot write executables here,” the operation is denied. The payload never touches the file system, so it never executes. No CROSSROAD downloader means no SHINYROAD backdoor, no persistence, no data exfiltration.
This approach works on zero-day malware variants because it doesn’t rely on recognizing the threat — it controls which programs are allowed to perform which file operations. UNC7017 could have used a completely novel malware family, and the result would be the same: blocked at the file write attempt.
The Upstream Intervention Advantage
Most security tools focus on detecting malware after it executes. EDR platforms watch for suspicious process behavior, antivirus scans files after they land, and SIEM systems correlate alerts after the fact. FileSure operates earlier in the attack chain — at the moment the malicious file attempts to write to disk.
An attack prevented at the delivery stage is fundamentally different from damage mitigated after execution. If the payload never lands, you don’t need to worry about detecting its behavior, containing its spread, or cleaning up encrypted files. The entire attack chain stops before it starts.
For supply chain attacks specifically, this upstream intervention is critical. These attacks succeed precisely because they come from trusted sources. Behavioral detection struggles when the delivery mechanism is legitimate. But file-level policy enforcement doesn’t care whether the updater is trusted — it only cares whether that specific program is authorized to write that specific file type to that specific location.
Organizations running FileSure on their endpoints would have seen the AOMEI updater attempt to write an executable, the kernel filter driver would have blocked it, and the security team would have received an alert with the full context: which user, which machine, which program, which file, and which policy rule triggered. Investigation starts immediately, before any damage occurs.
Ready to stop supply chain attacks at the file system layer? Start your free 21-day trial at bystorm.com and see how kernel-level file access control blocks malware delivery — even from trusted vendors.
Source: UNC7017 AOMEI Supply Chain Attack Delivers Malware
Category: Threat Intelligence
Tags: unc7017, aomei, supply chain attack, crossroad, shinyroad, kernel filter driver, file system security, malware delivery
