[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1195-002":3},{"item":4,"lessons":18,"controls":69,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1195-002","T1195.002","Compromise Software Supply Chain",12,"MITRE","**What attackers do.** Attackers modify legitimate software, for example by compromising a vendor's build system or update channel, so that customers install a tampered version. This Supply Chain Compromise sub-technique serves Initial Access and can reach many victims at once.\n\n**How to defend.** Assess the security of key software suppliers, verify signatures and hashes, and stage updates in a test environment before wide deployment where feasible. Restrict network access for software that does not need the internet, which limits a tampered update's ability to call home. Monitor trusted software for new behaviour.\n\n**Signs to look for.** Look for trusted applications contacting unfamiliar domains after an update, unexpected child processes, and vendor or community advisories about compromised builds. A common gap is excluding trusted vendor software from security monitoring to reduce noise.","Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update\u002Fdistribution mechanism for that software, or replacing compiled releases with a modified version.\n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F002\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},16,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"compromised-update-server-grounds-german-military-drones","Compromised Update Server Grounds German Military Drones","2026-11-13T18:20:23.075+00:00",{"slug":26,"title":27,"published_at":28},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","2026-11-13T14:20:41.076+00:00",{"slug":30,"title":31,"published_at":32},"ai-coding-tools-become-supply-chain-attack-vectors-for-credential-theft","AI Coding Tools Become Supply Chain Attack Vectors for Credential Theft","2026-11-12T12:20:57.94+00:00",{"slug":34,"title":35,"published_at":36},"poisoned-cpguard-update-exposes-thousands-of-hosting-servers","Poisoned cPGuard Update Exposes Thousands of Hosting Servers","2026-11-04T12:22:07.68+00:00",{"slug":38,"title":39,"published_at":40},"needymantis-malware-exploits-daemon-tools-supply-chain-compromise","NeedyMantis Malware Exploits Daemon Tools Supply Chain Compromise","2026-09-29T10:20:21.606+00:00",{"slug":42,"title":43,"published_at":44},"needymantis-malware-exploits-supply-chain-foothold-for-long-term-espionage","NeedyMantis Malware Exploits Supply Chain Foothold for Long-Term Espionage","2026-09-28T18:22:15.689+00:00",{"slug":46,"title":47,"published_at":48},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","2026-09-04T16:20:41.753+00:00",{"slug":50,"title":51,"published_at":52},"bgp-hijack-poisons-software-update-channel-to-deploy-persistent-rootkit","BGP Hijack Poisons Software Update Channel to Deploy Persistent Rootkit","2026-09-02T15:20:23.344+00:00",{"slug":54,"title":55,"published_at":56},"unpatched-trueconf-servers-used-to-backdoor-video-conference-participants","Unpatched TrueConf Servers Used to Backdoor Video Conference Participants","2026-08-11T15:20:22.788+00:00",{"slug":58,"title":59,"published_at":60},"unpatched-trueconf-servers-used-to-deliver-backdoored-installers","Unpatched TrueConf Servers Used to Deliver Backdoored Installers","2026-08-08T16:20:21.379+00:00",{"slug":62,"title":63,"published_at":64},"multi-vector-week-supply-chain-poisoning-phishing-backdoors-telecom-espionage","Multi-Vector Week: Supply Chain Poisoning, Phishing Backdoors & Telecom Espionage","2026-08-06T16:20:32.867+00:00",{"slug":66,"title":67,"published_at":68},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","2026-08-05T08:21:16.411+00:00",[70,75,80,84,89,94],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",15,{"slug":76,"name":77,"problem":78,"stories":79},"patch-management","Automated patch management","Known holes get closed in days, not months.",8,{"slug":81,"name":82,"problem":83,"stories":79},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":85,"name":86,"problem":87,"stories":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",3,{"slug":90,"name":91,"problem":92,"stories":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,{"slug":95,"name":96,"problem":97,"stories":93},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[99,104,110,115,120,124,129,134],{"family":100,"item":101,"code":102,"title":103,"together":74},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",10,{"family":111,"item":112,"code":113,"title":114,"together":109},"nist-800-53","si-7","SI-7","Software, Firmware, and Information Integrity",{"family":100,"item":116,"code":117,"title":118,"together":119},"13","Control 13","Network Monitoring and Defense",9,{"family":100,"item":121,"code":122,"title":123,"together":79},"7","Control 7","Continuous Vulnerability Management",{"family":125,"item":126,"code":127,"title":128,"together":79},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",{"family":130,"item":131,"code":132,"title":132,"together":133},"itil","overview","ITIL",7,{"family":111,"item":135,"code":136,"title":137,"together":133},"sa-12","SA-12","Supply Chain Protection"]