Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
25 IOCs
Investigating Ephemeral Supply Chain Tampering
Threat Actors
Malware Families
Excerpt
Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers. Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →25 indicators
IOC Relationship Graph
Building graph…