Search — “UNC7017”

The brief says UNC7017 modified AOMEI's unsigned update-config files three times between May and July, so clients checking for updates received a CROSSROAD/SHINYROAD backdoor. AOMEI has fixed the servers, but hosts infected during those windows remain compromised, and victims span 11 countries. The only source supplied has no technical content, so no behaviors or indicators are available; hunters should review AOMEI Backupper update activity from April to July.