Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.12
- Avast CCleaner3 2018
- Command Five SK 2011
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1034 | Daggerfly | — |
| grp_g0115 | GOLD SOUTHFIELD | — |
| grp_g0080 | Cobalt Group | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g1036 | Moonstone Sleet | DPRK |
| grp_g0046 | FIN7 | — |
| grp_g0096 | APT41 | China |
| grp_g0027 | Threat Group-3390 | China |
| grp_g0034 | Sandworm Team | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.