Poisoned Pipeline / Techniques / T0180
Compromise services / servers
Artifact Security CI/CD Posture SCM Posture
Services (servers) compromise attack in the supply chain is a type of attack that targets the servers hosting the software development and distribution infrastructure.
This attack can happen when an attacker gains access to the server through a vulnerability, misconfiguration, or social engineering attack.
Once the attacker gains access to the server, they can modify the source code or software packages being distributed to include malicious code or backdoors.
This attack can compromise multiple software projects and potentially all users who download or use the compromised software.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1272 Audit server configuration
- M1720 Implement regular patches and updates
Detections
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (10)
- php.net git server Zerodium backdoor
- Polyfill.io CDN takeover
- Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure
- An attacker accessed Zeabur internal systems and some customer services on 14 October
- Exposed operator staging host reveals autonomous AI-agent crypto-theft fleet
- Webmin 1.890–1.920 build-server backdoor
- VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
- UNC7017 swapped AOMEI update config for minutes at a time
- OpenCode Console breach hit users who had linked external AI providers
- Brevo Cloudflare Worker ClickFix