Poisoned Pipeline / Incidents / AS218

AS218 · 2016-08

FossHub served MBR-overwriting installers

Windows softwareInstaller / update channel

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0209 Compromise package registry or CDN origin

supply-chain campaign

Sources

• https://web.archive.org/web/20160807013940/http://www.audacityteam.org/compromised-download-partner/
• https://web.archive.org/web/20161118223300/http://www.audacityteam.org/compromised-download-partner/
• https://web.archive.org/web/20161030034854/http://news.softpedia.com/news/hacker-compromises-fosshub-to-distribute-mbr-hijacking-malware-506932.shtml
• https://www.theregister.com/security/2016/08/05/classic-shell-hackers-we-infected-fosshub-so-ransomware-couldnt-and-yeah-also-for-fun/1258425
• https://coddec.github.io/Classic-Shell/www.classicshell.net/forum/viewtopic7812.html?f=7&t=6441
• https://www.classicshell.net/forum/viewtopic.php?p=27955