Supply chain attack
noun · MITRE ATT&CK T1195
Compromising a trusted supplier, software update or library to reach its customers, who install the malicious code believing it is legitimate.
Instead of attacking a well-defended organization directly, a supply chain attack goes after something that organization already trusts: a software vendor, an open-source package, a managed service provider or a hardware supplier. If the attacker can insert malicious code into a product's build or update process, every customer who installs the update receives it, digitally signed and delivered through official channels.
MITRE ATT&CK describes compromises of software dependencies and development tools, of software itself, and of hardware under Supply Chain Compromise (T1195).
Example
In 2020, attackers inserted a backdoor, later named SUNBURST, into updates of SolarWinds Orion, a network monitoring product used by thousands of organizations. Customers installed the signed update as usual, and the attackers then chose a smaller number of high-value victims, including government agencies, for follow-on intrusions. In 2024, a backdoor deliberately planted in the open-source compression library xz utils was discovered just before it reached most Linux distributions.
Why it matters for a SOC analyst
Supply chain attacks bypass the usual question "is this software trusted?", so detection depends on behavior: a monitoring tool or updater that suddenly connects to unusual domains, spawns shells or accesses credentials. Keeping an inventory of software and suppliers, and limiting the privileges of tools that run with high access, determines how quickly you can answer "are we affected?" when the next one is announced.
Related terms
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.
- Advanced persistent threat
A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.
- Trojan
Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.