APT-SOLARWINDS-BUILDInitial Access

Build-System Implant (SUNSPOT-class)

Implant on the build server replaces a source file at compile time so the official signed artefact ships a backdoor — SolarWinds Orion / 3CX-class chain.

§ Where this technique fits

APT-SOLARWINDS-BUILD is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Build-system implant → signed supply-chain backdoor (SolarWinds-class)
Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor.
step 3 / 7

§ What commonly comes next

01
Supply Chain Compromise
T1195 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Build-system implant → signed supply-chain backdoor (SolarWinds-class)

§ What commonly comes next