MBCProject-mbc-markdown/lateral-movement/supply-chain-compromise.md

ID	E1195
Objective(s)	Lateral Movement
Related ATT&CK Techniques	Supply Chain Compromise (T1195, T1474)
Version	2.0
Created	1 August 2019
Last Modified	17 August 2023

Supply Chain Compromise

The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods listed below supplement the information available and defined in ATT&CK and allow for lateral movement: Supply Chain Compromise (T1195, T1474).

Methods

Name	ID	Description
Abuse Enterprise Certificates	E1195.m01	Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see Exploit Private APIs below).
Exploit Private APIs	E1195.m02	Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.

Use in Malware

Name	Date	Method	Description
TrickBot	2016	--	TrickBot comes with a signed downloader component. [2]
YiSpecter	2015	E1195.m01	YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [1]
YiSpecter	2015	E1195.m02	Within the malware, use of the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [1]

References

[1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

[2] https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf