[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1195":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1195","T1195","Supply Chain Compromise",35,"MITRE","**What attackers do.** Attackers tamper with software, hardware or update mechanisms before they reach the victim, so that a trusted product delivers the compromise. This serves Initial Access and can affect many organisations at once through a single vendor.\n\n**How to defend.** Assess supplier security, keep a software bill of materials, and verify signatures and hashes of what you install. Pin dependency versions, use trusted internal repositories, and stage updates before broad rollout where possible. Monitor trusted software for behaviour changes, since a signed binary can still be malicious.\n\n**Signs to look for.** Watch for trusted applications making new network connections, unexpected child processes or file writes after an update, and advisories from vendors or the community about compromised releases. A common gap is assuming that a signed update from a known vendor needs no monitoring.","Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update\u002Fdistribution mechanisms\n* Compromised\u002Finfected system images (removable media infected at the factory) \n* Replacement of legitimate software with modified versions\n* Sales of modified\u002Fcounterfeit products to legitimate distributors\n* Shipment interdiction","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":25,"title":26,"published_at":27},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":29,"title":30,"published_at":31},"mercenary-spyware-hijacks-ad-networks-to-silently-infect-devices","Mercenary Spyware Hijacks Ad Networks to Silently Infect Devices","2026-10-15T12:21:42.608+00:00",{"slug":33,"title":34,"published_at":35},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","2026-10-13T16:20:16.436+00:00",{"slug":37,"title":38,"published_at":39},"malicious-linux-backdoors-impersonate-legitimate-mail-security-products","Malicious Linux Backdoors Impersonate Legitimate Mail Security Products","2026-10-02T14:20:37.948+00:00",{"slug":41,"title":42,"published_at":43},"zero-day-in-third-party-tool-enables-3875m-crypto-heist","Zero-Day in Third-Party Tool Enables $387.5M Crypto Heist","2026-10-01T06:20:19.87+00:00",{"slug":45,"title":46,"published_at":47},"compromised-identity-opens-door-to-cloud-devops-pipeline-takeover","Compromised Identity Opens Door to Cloud DevOps Pipeline Takeover","2026-09-29T18:21:58.594+00:00",{"slug":49,"title":50,"published_at":51},"four-emerging-cyber-threats-demand-proactive-resilience-planning","Four Emerging Cyber Threats Demand Proactive Resilience Planning","2026-09-29T12:20:52.94+00:00",{"slug":53,"title":54,"published_at":55},"needymantis-malware-enables-stealthy-long-term-persistence-via-dll-sideloading","NeedyMantis Malware Enables Stealthy Long-Term Persistence via DLL Sideloading","2026-09-28T22:21:46.583+00:00",{"slug":57,"title":58,"published_at":59},"crypto-hack-citrix-exploits-poisoned-placeholder-domain-highlight-multi-front-threat-week","Crypto Hack, Citrix Exploits & Poisoned Placeholder Domain Highlight Multi-Front Threat Week","2026-09-28T19:20:42.355+00:00",{"slug":61,"title":62,"published_at":63},"fake-app-installers-deliver-blockchain-powered-rat-via-clickfix-campaign","Fake App Installers Deliver Blockchain-Powered RAT via ClickFix Campaign","2026-09-22T00:21:00.635+00:00",{"slug":65,"title":66,"published_at":67},"fake-lastpass-installer-uses-microsoft-signed-driver-to-blind-security-tools","Fake LastPass Installer Uses Microsoft-Signed Driver to Blind Security Tools","2026-09-21T20:20:50.032+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",24,{"slug":75,"name":76,"problem":77,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",14,{"slug":80,"name":81,"problem":82,"stories":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",9,{"slug":85,"name":86,"problem":87,"stories":83},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",6,{"slug":94,"name":95,"problem":96,"stories":92},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[98,104,110,116,121,127,131,136],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","2","Control 2","Inventory and Control of Software Assets",29,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","si-3","SI-3","Malicious Code Protection",19,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",18,{"family":105,"item":117,"code":118,"title":119,"together":120},"sa-12","SA-12","Supply Chain Protection",17,{"family":122,"item":123,"code":124,"title":125,"together":126},"gdpr","32","Article 32","Security of processing",16,{"family":99,"item":128,"code":129,"title":130,"together":78},"7","Control 7","Continuous Vulnerability Management",{"family":99,"item":132,"code":133,"title":134,"together":135},"13","Control 13","Network Monitoring and Defense",13,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",12]