# What is Supply Chain Compromise?
Source: https://arsen.co/en/resources/supply-chain-compromise
Summary: Supply Chain Compromise is an initial access technique where raud actors manipulate software, hardware, or services before they reach the final target.

**Supply Chain Compromise maps to Initial Access in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). Instead of attacking the target directly, fraud actors compromise a trusted upstream component (a software vendor, an open-source dependency, a system image) and ride it into the target environment.**

## What can be compromised in the supply chain?

- Development tools and build environments
- Source code repositories (public or private)
- Open-source dependencies widely used by other projects
- Software update and distribution channels
- Pre-installed system images (hardware infected at the factory)
- Legitimate software replaced with trojanised versions at distribution

## Why is supply chain compromise particularly dangerous?

The target never has direct contact with the attacker. The compromise arrives through a trusted update or a legitimate-looking package. Detection is difficult because the malicious component carries the signing certificate and reputation of a genuine vendor.

Second-order supply chain attacks compound the risk: an attacker who compromises Vendor A can leverage that access to compromise Vendor A's customers (the actual targets), then those customers' own clients.

## What is the social engineering dimension?

[Social engineering](https://arsen.co/en/resources/social-engineering) is frequently used to insert the initial compromise (targeting developers with [spear-phishing](https://arsen.co/en/resources/spear-phishing) to steal repository credentials, or vendor staff with [vishing](https://arsen.co/en/resources/vishing) to authorise a malicious code change.

## Key takeaways

- Supply Chain Compromise targets trusted upstream vendors, not the final victim directly.
- Attack surfaces include software updates, open-source dependencies, and hardware images.
- Second-order attacks let a single upstream compromise reach thousands of downstream targets.
- Social engineering of developer and vendor staff is a primary insertion mechanism.
- Vendor security assessments, software bill of materials (SBOM), and signed update verification are key controls.
	

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)