T0862: Supply Chain Compromise
Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment.
Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.
Counterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. [1]
Yokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. [1]
F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. [2] The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).
Analyst context for executives and security teams
Supply Chain Compromise matters because it can bypass many perimeter assumptions: a trusted vendor download, patch, device, or delivery process may be the path into an ICS environment. For executives and operations leaders, the practical issue is not only malware risk but confidence that installed control-system products, firmware, software, and components are genuine, intact, and sourced through trusted channels. The ATT&CK object also highlights counterfeit ICS devices as a safety and operational risk, making this relevant to both cyber resilience and physical process assurance.
Executive priority
Treat this as a governance and assurance problem, not only a SOC alerting problem. Leaders should ask whether procurement, engineering, OT operations, IT, and security can prove supplier trust, verify software and device integrity, and respond if a vendor package or component is later found to be compromised or counterfeit. Priority should be highest where compromised IT assets could enable access toward OT assets, or where HMIs, engineering workstations, controllers, gateways, VPN servers, jump hosts, firewalls, or safety-related devices depend on third-party software, firmware, or hardware.
Technical view
ATT&CK provides no official detection text for T0862, but the relationship context includes DET0730, Detection of Supply Chain Compromise, and multiple mitigations focused on supply chain management, code signing, auditing, vulnerability scanning, and software updates. SOC, detection, and IR teams should validate whether they can reconstruct the provenance and integrity of software installers, patches, firmware, device images, and newly introduced hardware across the ICS asset types targeted by this technique. Special attention should be paid to workstations, HMIs, application servers, control servers, data historians, jump hosts, VPN servers, data gateways, firewalls, controllers, PLCs, RTUs, IEDs, PACs, safety controllers, switches, and field I/O because the relationship set indicates broad potential target relevance across IT-like, embedded, and networked ICS assets.
Likely telemetry
- Software installation and update records for ICS/SCADA applications, patches, and vendor tools
- File integrity evidence such as hashes, digital signature verification results, and known-good baselines
- Firmware, program, configuration, and device integrity check results, especially after reboots, downloads, or restarts
- Asset inventory records linking devices and software to trusted suppliers and approved procurement paths
- Vulnerability scan and audit findings for systems, permissions, insecure software, and insecure configurations where scanning is operationally acceptable
Detection direction
- Validate DET0730-style coverage against the actual supply-chain workflow: procurement, download, staging, installation, commissioning, update, and maintenance.
- Tune detections around integrity failures, unsigned or improperly signed binaries, unexpected installer behavior, unexpected firmware or configuration changes, and divergence from known-good device or software baselines.
- Correlate technical telemetry with asset inventory and supplier records; a binary hash or device serial number is more useful when defenders know what should have been installed, from whom, and when.
- Account for false positives from legitimate maintenance windows, emergency patches, engineering downloads, and vendor support activity by requiring change records and approved-source evidence.
- Do not rely only on endpoint alerts. Counterfeit devices and manipulated firmware may require procurement evidence, device inspection, cryptographic verification, and engineering validation.
Mitigation priorities
- Establish or validate a supply chain management program requiring trusted suppliers and integrity testing for devices and components, aligned to M0817.
- Enforce code signing and digital signature verification for binaries and applications where supported, aligned to M0945.
- Perform periodic audits and integrity checks of systems, permissions, software, configurations, firmware, programs, and device states, aligned to M0947.
- Use vulnerability scanning to identify exploitable software weaknesses where scanning is safe for the ICS environment, aligned to M0916.
- Maintain regular software updates while scheduling around operational downtime and OT change-control requirements, aligned to M0951.
Analyst notes and limits
The supplied ATT&CK object includes examples involving counterfeit Yokogawa differential pressure transmitters and trojanized ICS/SCADA vendor website installers associated with Havex reporting. It also includes a relationship showing Dragonfly uses this technique, but this take does not infer current activity or local exposure from that relationship alone. The strongest defensive value is in proving provenance, integrity, and change control across the full ICS supply chain rather than treating this as a single malware detection problem.
ATT&CK does not provide official detection text, tactics, or platforms for the technique itself. Platform detail is only available through related targeted ICS assets, so local asset architecture is required to determine where coverage applies. Detection and mitigation feasibility will vary by vendor support, operational downtime constraints, embedded device capabilities, and the organization’s procurement and engineering processes.
Supply Chain Compromise
Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment.
Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.
Counterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. [1]
Yokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. [1]
F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. [2] The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0088: TEMP.Veles
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.[1][2][3]
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
S0093: Backdoor.Oldrea
Backdoor.Oldrea is a modular backdoor that used by Dragonfly against energy companies since at least 2013. Backdoor.Oldrea was distributed via supply chain compromise, and included specialized modules to enumerate and map ICS-specific systems, processes, and protocols.[1][2][3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 1d75d098a7b1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Control Global May 2019
Control Global 2019, May 29 Yokogawa announcement warns of counterfeit transmitters Retrieved. 2021/04/09
Open source URL -
[2]
Daavid Hentunen, Antti Tikkanen June 2014
Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01
Open source URL -
[3]
mitre-attack T0862Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.