Sendmail FTP tarball shipped trojan

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files
T0209 Compromise package registry or CDN origin

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

T0209 · Initial Access · Compromise package registry or CDN origin

Distribution origin hosted the trojanized artifact.

Sources

https://web.archive.org/web/20140720105607/http://www.cert.org/advisories/CA-2002-28.html
https://seclists.org/bugtraq/2002/Oct/122
https://www.exploit-db.com/exploits/21919
https://www.theregister.com/2002/10/11/sendmail_trojan_looks_familiar/
https://web.archive.org/web/20210515121835/https://www.securityfocus.com/bid/5921/info
https://nvd.nist.gov/vuln/detail/CVE-1999-0661