[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1195":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1195","T1195","Supply Chain Compromise",35,"MITRE","**What attackers do.** Attackers tamper with software, hardware or update mechanisms before they reach the victim, so that a trusted product delivers the compromise. This serves Initial Access and can affect many organisations at once through a single vendor.\n\n**How to defend.** Assess supplier security, keep a software bill of materials, and verify signatures and hashes of what you install. Pin dependency versions, use trusted internal repositories, and stage updates before broad rollout where possible. Monitor trusted software for behaviour changes, since a signed binary can still be malicious.\n\n**Signs to look for.** Watch for trusted applications making new network connections, unexpected child processes or file writes after an update, and advisories from vendors or the community about compromised releases. A common gap is assuming that a signed update from a known vendor needs no monitoring.","Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update\u002Fdistribution mechanisms\n* Compromised\u002Finfected system images (removable media infected at the factory) \n* Replacement of legitimate software with modified versions\n* Sales of modified\u002Fcounterfeit products to legitimate distributors\n* Shipment interdiction","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},51,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","2026-11-13T22:21:35.043+00:00",{"slug":26,"title":27,"published_at":28},"north-korean-facestealer-social-engineering-and-open-source-compromise-fuel-400m-crypto-theft","North Korean FaceStealer: Social Engineering and Open-Source Compromise Fuel $400M Crypto Theft","2026-11-13T15:21:17.928+00:00",{"slug":30,"title":31,"published_at":32},"ai-coding-agents-hijacked-via-poisoned-training-data-and-model-checkpoints","AI Coding Agents Hijacked via Poisoned Training Data and Model Checkpoints","2026-11-12T18:20:37.986+00:00",{"slug":34,"title":35,"published_at":36},"search-poisoning-and-malware-as-a-service-infrastructure-dismantled-in-operation-endgame","Search Poisoning and Malware-as-a-Service Infrastructure Dismantled in Operation Endgame","2026-11-12T17:20:20.882+00:00",{"slug":38,"title":39,"published_at":40},"client-side-supply-chain-attacks-bypass-all-traditional-security-controls","Client-Side Supply Chain Attacks Bypass All Traditional Security Controls","2026-11-12T15:22:17.578+00:00",{"slug":42,"title":43,"published_at":44},"hidden-ai-backdoors-can-survive-standard-evaluations-via-dormant-neuron-manipulation","Hidden AI Backdoors Can Survive Standard Evaluations via Dormant Neuron Manipulation","2026-11-11T12:20:24.174+00:00",{"slug":46,"title":47,"published_at":48},"sleeper-agents-can-be-hidden-in-ai-models-by-editing-just-a-few-neurons","Sleeper Agents Can Be Hidden in AI Models by Editing Just a Few Neurons","2026-11-11T01:20:24.17+00:00",{"slug":50,"title":51,"published_at":52},"north-korean-hackers-weaponize-developer-credentials-and-trojanized-software-to-infiltrate-supply-ch","North Korean Hackers Weaponize Developer Credentials and Trojanized Software to Infiltrate Supply Chains","2026-11-10T15:21:37.617+00:00",{"slug":54,"title":55,"published_at":56},"refrigeration-cyberattacks-and-botnet-compromises-expose-ot-and-iot-blind-spots","Refrigeration Cyberattacks and Botnet Compromises Expose OT and IoT Blind Spots","2026-11-08T10:20:26.939+00:00",{"slug":58,"title":59,"published_at":60},"manufacturer-backdoor-fuels-13m-device-xcpe-botnet","Manufacturer Backdoor Fuels 1.3M-Device XCPE Botnet","2026-11-04T17:21:02.558+00:00",{"slug":62,"title":63,"published_at":64},"13m-android-tv-boxes-hijacked-via-malware-embedded-by-device-manufacturer","1.3M Android TV Boxes Hijacked via Malware Embedded by Device Manufacturer","2026-11-03T11:22:14.085+00:00",{"slug":66,"title":67,"published_at":68},"preinstalled-malware-in-android-tv-boxes-powers-13m-device-botnet","Preinstalled Malware in Android TV Boxes Powers 1.3M Device Botnet","2026-11-03T03:20:22.59+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",28,{"slug":76,"name":77,"problem":78,"stories":79},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",17,{"slug":81,"name":82,"problem":83,"stories":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",14,{"slug":86,"name":87,"problem":88,"stories":89},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",12,{"slug":91,"name":92,"problem":93,"stories":94},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",10,{"slug":96,"name":97,"problem":98,"stories":99},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",9,[101,107,113,118,123,129,135,140],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","2","Control 2","Inventory and Control of Software Assets",29,{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-800-53","sa-12","SA-12","Supply Chain Protection",21,{"family":108,"item":114,"code":115,"title":116,"together":117},"si-3","SI-3","Malicious Code Protection",20,{"family":102,"item":119,"code":120,"title":121,"together":122},"13","Control 13","Network Monitoring and Defense",19,{"family":124,"item":125,"code":126,"title":127,"together":128},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",18,{"family":130,"item":131,"code":132,"title":133,"together":134},"gdpr","32","Article 32","Security of processing",16,{"family":102,"item":136,"code":137,"title":138,"together":139},"7","Control 7","Continuous Vulnerability Management",15,{"family":108,"item":141,"code":142,"title":143,"together":144},"si-2","SI-2","Flaw Remediation",13]