Mandiant (Google)Published
Investigating Ephemeral Supply Chain Tampering
By Mandiant, Google Threat Intelligence Group
Excerpt
Written by: Tyler McLellan
Introduction
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers. Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first time that we have encountered a software supply chain com…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on cloud.google.com.
Mentioned in the excerpt
More from Mandiant (Google)32
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- Mandiant Cybersecurity ConsultingMandiant (Google) · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
- Beyond source code: The files AI coding agents trust — and attackers exploitMandiant (Google) · Published 12 May
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflowsgitguardian.com · Published 5 Sep 2025
