| ID | Name |
|---|---|
| T1195.001 | Compromise Software Dependencies and Development Tools |
| T1195.002 | Compromise Software Supply Chain |
| T1195.003 | Compromise Hardware Supply Chain |
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.[1][2]
| ID | Name | Description |
|---|---|---|
| G0096 | APT41 |
APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.[3] |
| S0222 | CCBkdr |
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.[4][5][1] |
| G0080 | Cobalt Group |
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor. [6] |
| G0035 | Dragonfly |
Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.[7][8] |
| G0046 | FIN7 |
FIN7 has gained initial access by compromising a victim's software supply chain.[9] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.[10][11][12] |
| S0493 | GoldenSpy |
GoldenSpy has been packaged with a legitimate tax preparation software.[13] |
| G0034 | Sandworm Team |
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.[14][15][16] |
| C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.[17][18][19][20] |
| S0562 | SUNSPOT |
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.[21] |
| G0027 | Threat Group-3390 |
Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.[22] |
| ID | Mitigation | Description |
|---|---|---|
| M1051 | Update Software |
A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation. |
| M1016 | Vulnerability Scanning |
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.[23] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0022 | File | File Metadata |
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. |