SHINYROAD

AOMEI Backupper Update Tampering Hid in Brief Bursts

Google and Mandiant say UNC7017 tampered with AOMEI Backupper updates in brief bursts, directing update clients to CROSSROAD and SHINYROAD malware.