Supply Chain Compromise: Compromise Software Supply Chain

Adversaries may manipulate application software prior to receipt by the end user for the purpose of data or system compromise. Supply Chain Compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.[1] [2]

Procedure Examples

Name Description
APT17

APT17 is suspected to be the APT group behind the supply chain compromise of CCleaner and the distribution of the backdoored version to over 2 million CCleaner users.

APT41

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.[3]

CCBkdr

CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.[4][5][1]

Sandworm Team

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.[6][7]

ShadowHammer

ShadowHammer refers to a backdoor inserted in a Software Supply Chain Compromise to ASUS Live Update Utility and delivered to over a million ASUS users.

ShadowPad

ShadowPad backdoor was inserted into a dynamic link library (dll) file of NetSarang, a server management software and delivered to NetSarang's users in a Software Supply Chain Compromise.

SUNSPOT

SUNSPOT malware was designed and used to insert SUNBURST into the software build of the SolarWinds Orion IT management product.[8]

UNC2452

UNC2452 gained initial network access via a trojanized update of SolarWinds Orion software.[9]

Winnti Group

Winnti Group targets the development pipeline of gaming and adware software companies to backdoor the software and compromise the Supply Chain

Mitigations

Mitigation Description
Update Software

A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation.

Vulnerability Scanning

Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.[10]

Detection

Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

References

Attachments

ID
VT0004.002
Sub-techniques
Tactic
Initial Access
Platforms
Linux
Windows
macOS
Data Sources
File monitoring
Web proxy
Version
1.0

Created: 01 December 2020

Last Modified: 27 December 2020