Supply Chain Compromise maps to Initial Access in the MITRE F3 Framework. Instead of attacking the target directly, fraud actors compromise a trusted upstream component (a software vendor, an open-source dependency, a system image) and ride it into the target environment.
What can be compromised in the supply chain?
- Development tools and build environments
- Source code repositories (public or private)
- Open-source dependencies widely used by other projects
- Software update and distribution channels
- Pre-installed system images (hardware infected at the factory)
- Legitimate software replaced with trojanised versions at distribution
Why is supply chain compromise particularly dangerous?
The target never has direct contact with the attacker. The compromise arrives through a trusted update or a legitimate-looking package. Detection is difficult because the malicious component carries the signing certificate and reputation of a genuine vendor.
Second-order supply chain attacks compound the risk: an attacker who compromises Vendor A can leverage that access to compromise Vendor A's customers (the actual targets), then those customers' own clients.
What is the social engineering dimension?
Social engineering is frequently used to insert the initial compromise (targeting developers with spear-phishing to steal repository credentials, or vendor staff with vishing to authorise a malicious code change.
Key takeaways
- Supply Chain Compromise targets trusted upstream vendors, not the final victim directly.
- Attack surfaces include software updates, open-source dependencies, and hardware images.
- Second-order attacks let a single upstream compromise reach thousands of downstream targets.
- Social engineering of developer and vendor staff is a primary insertion mechanism.
- Vendor security assessments, software bill of materials (SBOM), and signed update verification are key controls.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
