Supply Chain Compromise

{
  "id": "ATTACK:enterprise:T1195",
  "title": "Supply Chain Compromise",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1195",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3f18edba-28f4-4bb9-82c3-8aa60dcac5f7",
  "external_id": "T1195",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2025-10-24T17:48:41.675Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "Avast CCleaner3 2018",
      "url": "https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities"
    },
    {
      "source_name": "Krebs 3cx overview 2023",
      "url": "https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/"
    },
    {
      "source_name": "Command Five SK 2011",
      "url": "https://web.archive.org/web/20160309235002/https://www.commandfive.com/papers/C5_APT_SKHack.pdf"
    },
    {
      "source_name": "IBM Storwize",
      "url": "https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028-_-OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206-_-E"
    },
    {
      "source_name": "Symantec Elderwood Sept 2012",
      "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
    },
    {
      "source_name": "Schneider Electric USB Malware",
      "url": "https://www.se.com/us/en/download/document/SESN-2018-236-01/"
    },
    {
      "source_name": "Trendmicro NPM Compromise",
      "url": "https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets"
    },
    {
      "source_name": "Microsoft Dofoil 2018",
      "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/"
    }
  ]
}