What attackers do. Attackers tamper with software, hardware or update mechanisms before they reach the victim, so that a trusted product delivers the compromise. This serves Initial Access and can affect many organisations at once through a single vendor.
How to defend. Assess supplier security, keep a software bill of materials, and verify signatures and hashes of what you install. Pin dependency versions, use trusted internal repositories, and stage updates before broad rollout where possible. Monitor trusted software for behaviour changes, since a signed binary can still be malicious.
Signs to look for. Watch for trusted applications making new network connections, unexpected child processes or file writes after an update, and advisories from vendors or the community about compromised releases. A common gap is assuming that a signed update from a known vendor needs no monitoring.