Poisoned Pipeline / Incidents / AS270
UnrealIRCd tarball enabled remote execution
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
- T0209 Compromise package registry or CDN origin
supply-chain campaign
Distribution origin hosted the trojanized artifact.
Sources
- https://forums.unrealircd.org/viewtopic.php?t=6562
- https://www.rapid7.com/db/modules/exploit/unix/irc/unreal_ircd_3281_backdoor/
- https://lwn.net/Articles/392201/
- https://www.theregister.com/software/2010/06/14/linux-irc-server-leaves-backdoor-open/1373423
- https://arstechnica.com/information-technology/2010/06/unreal-ircd-backdoored-for-months/
- https://seclists.org/dailydave/2010/q2/56