Skip to content
attack.paths
Anmelden
← RegistryDossier · 7 steps · 6 edges

Build-system implant → signed supply-chain backdoor (SolarWinds-class)

Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target software vendor signs binaries with a real cert, runs an automated build server, and trusts the result without re-validating source from a separate gold copy. 3CX / SolarWinds class.

§ Steps

  1. 01
    Selectively target high-value installsInitial Access
    T1078— Valid Accounts
  2. 02
    Foothold inside vendor network (phish / VPN cred)Initial Access
    T1078— Valid Accounts
  3. 03
    Build server emits backdoored signed artefactInitial Access
    T1195— Supply Chain Compromise
  4. 04
    Subset of installs beacon to attackerCommand and Control
    T1071— Application Layer Protocol
  5. 05
    Map vendor build infraReconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  6. 06
    Customers auto-update, mass installPersistence
    SUP-ACTION-TAG-MUTATION— GitHub Action Tag Mutation
  7. 07
    Implant on the build agent (SUNSPOT-class)Initial Access
    APT-SOLARWINDS-BUILD— Build-System Implant (SUNSPOT-class)

§ References

§ Frequently asked

What is the "Build-system implant → signed supply-chain backdoor (SolarWinds-class)" attack path?
Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor. It chains 7 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Selectively target high-value installs (T1078) — a initial access primitive. Assumed environment: target software vendor signs binaries with a real cert, runs an automated build server, and trusts the result without re-validating source from a separate gold copy.
What is the final impact of this kill-chain?
The final step lands on Implant on the build agent (SUNSPOT-class) (APT-SOLARWINDS-BUILD), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers