LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1474: Supply Chain Compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction

While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency, specifically with the widespread usage of third-party advertising libraries.[1][2]

MobileT1474TechniqueObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

T1474: Supply Chain Compromise describes Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected syste...

Executive priority

T1474: Supply Chain Compromise is an official MITRE ATT&CK technique. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate T1474: Supply Chain Compromise by reviewing the official ATT&CK relationships, mapped tactics (initial-access), supported platforms (Android, iOS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether T1474: Supply Chain Compromise appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Supply Chain Compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Supply chain compromise can take place at any stage of the supply chain including:

* Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction

While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency, specifically with the widespread usage of third-party advertising libraries.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

6 rows
DomainIDNameRelationship / procedure
Mobile—Insecure Third-Party LibrariesInsecure Third-Party Libraries revoked by this object.
MobileT1474.002Compromise Hardware Supply ChainSub-techniqueCompromise Hardware Supply Chain subtechnique of this object.
MobileT1474.001Compromise Software Dependencies and Development ToolsSub-techniqueCompromise Software Dependencies and Development Tools subtechnique of this object.
Mobile—Malicious or Vulnerable Built-in Device FunctionalityMalicious or Vulnerable Built-in Device Functionality revoked by this object.
Mobile—Malicious Software Development ToolsMalicious Software Development Tools revoked by this object.
MobileT1474.003Compromise Software Supply ChainSub-techniqueCompromise Software Supply Chain subtechnique of this object.
Relationship explorer

All related ATT&CK context

mitigates · MitigationM1013: Application Developer GuidanceMobilemitigates · MitigationM1001: Security UpdatesMobilerevoked by · TechniqueInsecure Third-Party LibrariesMobiledetects · Detection StrategyDET0628: Detection of Supply Chain CompromiseMobilesubtechnique of · TechniqueT1474.002: Compromise Hardware Supply ChainMobilesubtechnique of · TechniqueT1474.001: Compromise Software Dependencies and Development ToolsMobilerevoked by · TechniqueMalicious or Vulnerable Built-in Device FunctionalityMobilerevoked by · TechniqueMalicious Software Development ToolsMobilesubtechnique of · TechniqueT1474.003: Compromise Software Supply ChainMobile
Mitigations

Mitigation direction

MitigationMobile

M1013: Application Developer Guidance

Application Developer Guidance focuses on providing developers with the knowledge, tools, and best practices needed to write secure code, reduce vulnerabilities, and implement secure design principles. By integrating security throughout the software development lifecycle (SDLC), this mitigation aims to prevent the introduction of exploitable weaknesses in applications, systems, and APIs. This mitigation can be implemented through the following measures: Preventing SQL Injection (Secure Coding Practice):

- Implementation: Train developers to use parameterized queries or prepared statements instead of directly embedding user input into SQL queries. - Use Case: A web application accepts user input to search a database. By sanitizing and validating user inputs, developers can prevent attackers from injecting malicious SQL commands.

Cross-Site Scripting (XSS) Mitigation:

- Implementation: Require developers to implement output encoding for all user-generated content displayed on a web page. - Use Case: An e-commerce site allows users to leave product reviews. Properly encoding and escaping user inputs prevents malicious scripts from being executed in other users’ browsers.

Secure API Design:

- Implementation: Train developers to authenticate all API endpoints and avoid exposing sensitive information in API responses. - Use Case: A mobile banking application uses APIs for account management. By enforcing token-based authentication for every API call, developers reduce the risk of unauthorized access.

Static Code Analysis in the Build Pipeline:

- Implementation: Incorporate tools into CI/CD pipelines to automatically scan for vulnerabilities during the build process. - Use Case: A fintech company integrates static analysis tools to detect hardcoded credentials in their source code before deployment.

Threat Modeling in the Design Phase:

- Implementation: Use frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design. - Use Case: Before launching a customer portal, a SaaS company identifies potential abuse cases, such as session hijacking, and designs mitigations like secure session management.

**Tools for Implementation**:

- Static Code Analysis Tools: Use tools that can scan for known vulnerabilities in source code. - Dynamic Application Security Testing (DAST): Use tools like Burp Suite or OWASP ZAP to simulate runtime attacks and identify vulnerabilities. - Secure Frameworks: Recommend secure-by-default frameworks (e.g., Django for Python, Spring Security for Java) that enforce security best practices.

MitigationMobile

M1001: Security Updates

Install security updates in response to discovered vulnerabilities.

Purchase devices with a vendor and/or mobile carrier commitment to provide security updates in a prompt manner for a set period of time.

Decommission devices that will no longer receive security updates.

Limit or block access to enterprise resources from devices that have not installed recent security updates.

On Android devices, access can be controlled based on each device's security patch level. On iOS devices, access can be controlled based on the iOS version.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
2.1
Created
Modified
Raw hash
3b515ee75a31836a...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.1Current bundle3b515ee75a31…
19.12.1Older bundle3b515ee75a31…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Grace-Advertisement

    M. Grace et al. (2012, April 16-18). Unsafe exposure analysis of mobile in-app advertisements. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    NowSecure-RemoteCode

    Ryan Welton. (2015, June 15). A Pattern for Remote Code Execution using Arbitrary File Writes and MultiDex Applications. Retrieved December 22, 2016.

    Open source URL
  3. [3]
    NIST Mobile Threat CatalogueAPP-6
    Open source URL
  4. [4]
    NIST Mobile Threat CatalogueSPC-0
    Open source URL
  5. [5]
    NIST Mobile Threat CatalogueSPC-1
    Open source URL
  6. [6]
    NIST Mobile Threat CatalogueSPC-10
    Open source URL
  7. [7]
    NIST Mobile Threat CatalogueSPC-11
    Open source URL
  8. [8]
    NIST Mobile Threat CatalogueSPC-12
    Open source URL
  9. [9]
    NIST Mobile Threat CatalogueSPC-13
    Open source URL
  10. [10]
    NIST Mobile Threat CatalogueSPC-14
    Open source URL
  11. [11]
    NIST Mobile Threat CatalogueSPC-15
    Open source URL
  12. [12]
    NIST Mobile Threat CatalogueSPC-16
    Open source URL
  13. [13]
    NIST Mobile Threat CatalogueSPC-17
    Open source URL
  14. [14]
    NIST Mobile Threat CatalogueSPC-18
    Open source URL
  15. [15]
    NIST Mobile Threat CatalogueSPC-19
    Open source URL
  16. [16]
    NIST Mobile Threat CatalogueSPC-2
    Open source URL
  17. [17]
    NIST Mobile Threat CatalogueSPC-20
    Open source URL
  18. [18]
    NIST Mobile Threat CatalogueSPC-21
    Open source URL
  19. [19]
    NIST Mobile Threat CatalogueSPC-3
    Open source URL
  20. [20]
    NIST Mobile Threat CatalogueSPC-4
    Open source URL
  21. [21]
    NIST Mobile Threat CatalogueSPC-5
    Open source URL
  22. [22]
    NIST Mobile Threat CatalogueSPC-6
    Open source URL
  23. [23]
    NIST Mobile Threat CatalogueSPC-7
    Open source URL
  24. [24]
    NIST Mobile Threat CatalogueSPC-8
    Open source URL
  25. [25]
    NIST Mobile Threat CatalogueSPC-9
    Open source URL
  26. [26]
    mitre-attackT1474
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use