Forensia CTI Core

About

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Platforms: Linux, Windows, macOSParent: T1195 Supply Chain CompromiseMITRE ATT&CK ↗

Used by actors

9 known groups

G0027 Threat Group-3390 G0034 Sandworm Team G0035 Dragonfly G0046 FIN7 G0080 Cobalt Group G0096 APT41 G0115 GOLD SOUTHFIELD G1034 Daggerfly G1036 Moonstone Sleet

Software

3 malware/tools implement this

CCBkdrGoldenSpySUNSPOT

Corpus indicators tagged with this technique

451 indicators in the corpus carry T1195.002.

Indicator	Type	Family	Sev	Src
92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61	hash	supply_chain	80	2
dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc	hash	supply_chain	80	2
9df3f0d8525edf2b88c4a150134c7699a85a1508	hash	—	80	2
5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290	hash	supply_chain	80	2
efac23b0e6395b1178bcf7086f72344b24c04dcc	hash	—	80	2
aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868	hash	supply_chain	80	2
c38954e85bf5433e61e7c8f4230336695624ae88b6953afabf7bf817aa91b638	hash	supply_chain	80	1
4ce45e016a304d813e67b29a08265b2101c2e15a09ace5de6539cad02567affe	sha256	supply_chain	80	1
c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2	sha256	supply_chain	80	1
50ffce607867d8fa8eaf6ef5cd25a3c0e7e4415e881b9e55c04a67bcddb74fdf	sha256	supply_chain	80	1
3dfc3d81572e16ceaae3d07922255eb88068b91d	hash	—	80	2
ac10f5b1d5ecab22b7b418d6e98fa18e32bbdeab	hash	—	80	2
865a1739337d3303b3ab02c5e694c22b79c42b7d	hash	—	80	2
9570f77a5e1511869f4e554e7166df9fde081f2583e293c2569621792ed7d9c9	hash	supply_chain	80	1
a40ee8ff313e59aa92d48592c494a4c3d81449af	hash	—	80	2
2194271c7991d60ae82436129d7f25c0a689050a	hash	—	80	2
7105caa6d4fd8a2c67523d385277528e556ae4f6	hash	—	80	2
82e579bd49d69845133c9aa8585f8bd26736437b	hash	—	80	2
17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871	sha256	supply_chain	80	1
164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3	sha256	supply_chain	80	1
d35695f2366a43628231e73ffa83ca106306a8fa	hash	—	80	2
282b9bc318ad1234cbd1b86424b784299b8be31545802a7c6b751166b814b990	sha256	supply_chain	80	1
c2eb1033bc01ab0fd732a7ba4967be02c0690bf0	hash	—	80	2
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
f6669bd504ce6b0e303be7ee47f2ebbc062989c88c41f0a3f436044a24869798	sha256	supply_chain	80	1
cc918f0da51794f0174437d336e6f3edfdd3cbe4	hash	—	80	2
f96bcd875836da89800912de1e557891697c7cf4	hash	—	80	2
fdcb35cd9cb8dc1474cbcdf1c9bb03200dcf3f18	hash	—	80	2
fe0161fb8a26a0bf4afad746c7ebf89499dcd3a7	hash	—	80	2
fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405	hash	supply_chain	80	2

Showing the top 30 by severity of 451.