T1195.002sub-technique of T1195 Supply Chain Compromise
Compromise Software Supply Chain
Linux · Windows · macOS3 pieces on this siteT1195.002 on attack.mitre.org
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
If this is happening now
Checklists and playbooks to open while the alert is still live.
A supplier tells you they were breached
A notification from a vendor, or their name in the news before their email arrives.
Read
Analyses, case studies, guides, references and interview questions.
Case study: the update was signed, and that was the problem
A trusted software update that carried a backdoor, worked as a case. Signing proved the build was the vendor's; it proved nothing about what was in it. Eight questions on detection, scope and the uncomfortable part, which is that nothing your endpoint controls were watching for was wrong.
Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest
CVE-2026-60004 turns repository write access into shell execution as the Gitea service account. The interesting part is not the injection. It is that Git hooks are executable files sitting inside a directory your developers write to all day.
how MITRE says to see it
Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
- Adversary ships a tampered application or update: an updater/installer (msiexec/setup/update.exe/vendor service) writes or replaces binaries; on first run it spawns scripts/shells or unsigned DLLs and beacons to non-approved update CDNs/hosts.
- A compromised package/update (deb/rpm/tarball/AppImage/vendor updater) is installed, writing/overwriting files in /usr/local/bin, /usr/bin, /opt, or ~/.local; first run executes unexpected shells/curl/wget and connects to unapproved hosts.
- A tampered app/pkg/notarized update is installed via installer, softwareupdated, Homebrew, or vendor updater; new Mach-O or bundle contents appear in /Applications, /Library, /usr/local or /opt/homebrew; first run spawns sh/zsh/osascript/curl and makes egress to unfamiliar domains; AMFI/Gatekeeper may log...
what reduces it
- M1016 Vulnerability Scanning. Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.
- M1051 Update Software. A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation.