← Threat archive

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

2 threats tracked by Spectrum Delta use this technique.

T1195.002 on MITRE ATT&CK →

  • OVHcloud CLI envchecker

    Compromise software supply chain: release-asset replacement

    CI pinned-checksum validation failures — the evidenced detection vector (the customer's CI platform was not reported; the release-asset modification itself was not observed in the customer's telemetry)

    Seen in: CI build logs (hash-pinned)

  • LiteLLM 1.107.0 backdoor

    Malicious wheel plants Python startup-hook files in site-packages outside the litellm application directory

    auditd/Sysmon file-create events for */site-packages/cook.pth, cook.py, sitecustomize.py outside the litellm package dir

    Implant artifact matching (IOC procedure)

    SIEM correlation of file hashes, domains and marker paths across auditd, EDR and proxy/DNS events

    Seen in: Linux auditd, Microsoft Defender for Endpoint / Sysmon, Web proxy / DNS logs