Supply Chain Compromise: Compromise Software Supply Chain
- ID
- T1195.002
- Tactics
- TA0001 Initial Access
- Sub-technique of
- T1195 Supply Chain Compromise
- Platforms
- Linux, Windows, macOS
- Data sources
- Process Creation, Driver Load, Module Load, File Creation, Windows Registry Key Modification, Network Connection Creation, File Metadata, Network Traffic Flow
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.[2][3]
Detection
- DET0309 Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
Data components: Process Creation, Driver Load, Module Load, File Creation, Windows Registry Key Modification, Network Connection Creation, File Metadata, Network Traffic Flow
Mitigations (2)
- M1016 Vulnerability Scanning
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.[1]
- M1051 Update Software
A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation.
Groups (9)
- G0027 Threat Group-3390
- G0034 Sandworm Team
- G0035 Dragonfly
- G0046 FIN7
- G0080 Cobalt Group
- G0096 APT41
- G0115 GOLD SOUTHFIELD
- G1034 Daggerfly
- G1036 Moonstone Sleet
Software (3)
References
- OWASP Top 10
- Avast CCleaner3 2018
- Command Five SK 2011