[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1195-002":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1195-002","T1195.002","Compromise Software Supply Chain",12,"MITRE","**What attackers do.** Attackers modify legitimate software, for example by compromising a vendor's build system or update channel, so that customers install a tampered version. This Supply Chain Compromise sub-technique serves Initial Access and can reach many victims at once.\n\n**How to defend.** Assess the security of key software suppliers, verify signatures and hashes, and stage updates in a test environment before wide deployment where feasible. Restrict network access for software that does not need the internet, which limits a tampered update's ability to call home. Monitor trusted software for new behaviour.\n\n**Signs to look for.** Look for trusted applications contacting unfamiliar domains after an update, unexpected child processes, and vendor or community advisories about compromised builds. A common gap is excluding trusted vendor software from security monitoring to reduce noise.","Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update\u002Fdistribution mechanism for that software, or replacing compiled releases with a modified version.\n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F002\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"needymantis-malware-exploits-daemon-tools-supply-chain-compromise","NeedyMantis Malware Exploits Daemon Tools Supply Chain Compromise","2026-09-29T10:20:21.606+00:00",{"slug":25,"title":26,"published_at":27},"needymantis-malware-exploits-supply-chain-foothold-for-long-term-espionage","NeedyMantis Malware Exploits Supply Chain Foothold for Long-Term Espionage","2026-09-28T18:22:15.689+00:00",{"slug":29,"title":30,"published_at":31},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","2026-09-04T16:20:41.753+00:00",{"slug":33,"title":34,"published_at":35},"bgp-hijack-poisons-software-update-channel-to-deploy-persistent-rootkit","BGP Hijack Poisons Software Update Channel to Deploy Persistent Rootkit","2026-09-02T15:20:23.344+00:00",{"slug":37,"title":38,"published_at":39},"unpatched-trueconf-servers-used-to-backdoor-video-conference-participants","Unpatched TrueConf Servers Used to Backdoor Video Conference Participants","2026-08-11T15:20:22.788+00:00",{"slug":41,"title":42,"published_at":43},"unpatched-trueconf-servers-used-to-deliver-backdoored-installers","Unpatched TrueConf Servers Used to Deliver Backdoored Installers","2026-08-08T16:20:21.379+00:00",{"slug":45,"title":46,"published_at":47},"multi-vector-week-supply-chain-poisoning-phishing-backdoors-telecom-espionage","Multi-Vector Week: Supply Chain Poisoning, Phishing Backdoors & Telecom Espionage","2026-08-06T16:20:32.867+00:00",{"slug":49,"title":50,"published_at":51},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","2026-08-05T08:21:16.411+00:00",{"slug":53,"title":54,"published_at":55},"apt-group-weaponizes-vipnet-update-mechanism-to-infiltrate-russian-gov-networks","APT Group Weaponizes ViPNet Update Mechanism to Infiltrate Russian Gov Networks","2026-07-19T16:20:21.849+00:00",{"slug":57,"title":58,"published_at":59},"apt-campaign-hijacks-trusted-vipnet-update-system-to-deploy-multi-stage-malware","APT Campaign Hijacks Trusted ViPNet Update System to Deploy Multi-Stage Malware","2026-07-16T16:22:25.943+00:00",{"slug":61,"title":62,"published_at":63},"trojanized-webex-zoom-installers-deliver-russian-rat","Trojanized WebEx & Zoom Installers Deliver Russian RAT","2026-07-16T12:21:52.97+00:00",{"slug":65,"title":66,"published_at":67},"iranian-hackers-exploit-sysaid-updates-and-it-providers-to-infiltrate-israeli-targets","Iranian Hackers Exploit SysAid Updates and IT Providers to Infiltrate Israeli Targets","2026-07-06T20:20:43.982+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",11,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":80,"name":81,"problem":82,"stories":83},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",4,{"slug":85,"name":86,"problem":87,"stories":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",3,{"slug":90,"name":91,"problem":92,"stories":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,{"slug":95,"name":96,"problem":97,"stories":93},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[99,104,110,115,120,125,129,134],{"family":100,"item":101,"code":102,"title":103,"together":9},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",10,{"family":100,"item":111,"code":112,"title":113,"together":114},"13","Control 13","Network Monitoring and Defense",9,{"family":116,"item":117,"code":118,"title":119,"together":114},"nist-800-53","si-7","SI-7","Software, Firmware, and Information Integrity",{"family":100,"item":121,"code":122,"title":123,"together":124},"7","Control 7","Continuous Vulnerability Management",8,{"family":126,"item":127,"code":128,"title":128,"together":78},"itil","overview","ITIL",{"family":130,"item":131,"code":132,"title":133,"together":78},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",{"family":116,"item":135,"code":136,"title":137,"together":138},"sa-12","SA-12","Supply Chain Protection",6]