Log in Request a demo

Attack technique

Compromise Software Supply Chain

Compromise Software Supply Chain is a way for attackers to reach many computers through software they already trust.

In short

Compromise Software Supply Chain is a way for attackers to reach many computers through software they already trust. They change an application before it gets to the user, for example in its source code, its update system or its download. MITRE ATT&CK lists it as an Initial Access technique.

Last updated 19 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Initial Access · Step 3 Of 15 In The Attack Chain

  1. MITRE IDT1195.002ATT&CK technique
  2. Detection3ways to spot it
  3. Defences3ways to stop itScan for known weaknesses · Know your update sources

How it works

MITRE says attackers can manipulate application software before the final user receives it. This can happen by changing source code, by tampering with the update or distribution mechanism, or by swapping compiled releases for modified versions.

The target can be narrow or broad. Some attackers aim at a chosen set of victims. Others reach a wide group and act only against selected victims later.

Because the software comes from a known vendor, the change often passes the checks that people and security tools apply to strangers. Our page on the supply chain attack explains the wider idea.

A real example

MITRE ATT&CK lists SUNSPOT, GoldenSpy and CCBkdr as using this technique, and describes the 3CX and SolarWinds compromises as campaigns that used it. A 2026 case of tampered update files is described in our AOMEI Backupper incident page.

How to detect

  1. Installers and updaters that write programs

    MITRE suggests linking an installer or updater that replaces program files with what happens next, such as scripts, shells or unsigned libraries starting on first run.

  2. Connections to hosts you did not approve

    Watch for software that contacts update hosts outside your approved list shortly after it installs or updates.

  3. Signature and notarization problems

    Check logs for failed or missing code signature checks when an update is applied.

How to defend

  1. Keep software updated and pruned

    MITRE advises a patch management process that also checks for unused, unmaintained or previously vulnerable software and unneeded features and files.

  2. Scan for known weaknesses

    Keep watching vulnerability sources and use automatic and manual code review tools, as MITRE advises.

  3. Know your update sources

    Keep a list of the hosts each product is allowed to fetch updates from, so a new host stands out.

In our research

  1. How a Trivy Compromise Reached LiteLLM Releases October 2026
  2. Cyber incidents of 2026: lessons from official reports October 2026
  3. Initial access techniques: all 11 in MITRE ATT&CK October 2026
  4. Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
  5. APT27 threat group profile Threat group
  6. APT29 Threat group

Sources

  1. MITRE ATT&CK T1195.002: Supply Chain Compromise: Compromise Software Supply Chain MITRE
  2. MITRE ATT&CK T1195: Supply Chain Compromise MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT27 threat group profile

Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies. The Justice Department charged two men it calls APT27 actors, alleging profit-driven hacking from 2013 to 2024.

Read more

Threat group

APT29

The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). In April 2021 the US and UK attributed the 2020 SolarWinds Orion compromise to the SVR, and MITRE says the group has operated since at least 2008.

Read more