# T1195.001 Compromise Software Dependencies and Development Tools > As of 2026-10-05, T1195.001 (Compromise Software Dependencies and Development Tools) appears in 90 tracked threats, first reported 2026-02-16 and most recently 2026-10-03, with linked actors including TeamPCP, APT38, Sapphire Sleet; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 90 (29 critical, 49 high, 9 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-10-03 - **Threat actors:** 39 - **Detection rules:** 334 (counts only; Blue tier and above) ## Key facts - **ID:** T1195.001 - **Framework:** MITRE ATT&CK - **Tactics:** Initial Access - **Matrix:** Enterprise - **Parent:** T1195 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1195/001/ ## Activity timeline T1195.001 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 21 reports, and 90 of the 90 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1195.001 Compromise Software Dependencies and Development Tools is catalogued by MITRE ATT&CK under the Initial Access tactic in the Enterprise matrix, as a sub-technique of [T1195 Supply Chain Compromise](https://intel.threadlinqs.com/technique/T1195). Threadlinqs maps 90 of 2623 tracked threats (3.4%) to it; by severity that is 29 critical, 49 high, 9 medium. Threats that use T1195.001 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (62 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (56 threats), [T1059.007 JavaScript](https://intel.threadlinqs.com/technique/T1059.007) (56 threats), [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (51 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (50 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 39 tracked threat actors appear in the threats that use T1195.001; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (14), [APT38](https://intel.threadlinqs.com/actor/APT38) (10), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (10), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (10), [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) (8). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1195.001. - [M1013 Application Developer Guidance](https://attack.mitre.org/mitigations/M1013/) - [M1016 Vulnerability Scanning](https://attack.mitre.org/mitigations/M1016/) - [M1033 Limit Software Installation](https://attack.mitre.org/mitigations/M1033/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) ## Data sources Telemetry that can reveal T1195.001, per MITRE ATT&CK. - File — File Metadata ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 14 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 10 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 10 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 10 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 8 - [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 5 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 3 - [Mini Shai-Hulud](https://intel.threadlinqs.com/actor/Mini%20Shai-Hulud) — 3 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 2 - [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) — 2 - [PolinRider](https://intel.threadlinqs.com/actor/PolinRider) — 2 ## Tracked threats The 30 most recent of 90 tracked threats that use T1195.001. - [AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app…](https://intel.threadlinqs.com/threat/TL-2026-2880) — high — 2026-10-03 - [Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-2806) — high — 2026-09-30 - [PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled…](https://intel.threadlinqs.com/threat/TL-2026-2785) — medium — 2026-09-29 - [North Korea-Linked XCTDH/OmniStealer Campaign Uses Ethereum Transactions (HashHiding) for Covert C2 Signaling](https://intel.threadlinqs.com/threat/TL-2026-2782) — high — 2026-09-29 - [Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini…](https://intel.threadlinqs.com/threat/TL-2026-2661) — high — 2026-09-26 - [Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)](https://intel.threadlinqs.com/threat/TL-2026-2657) — high — 2026-09-26 - [DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…](https://intel.threadlinqs.com/threat/TL-2026-2635) — high — 2026-09-23 - [Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation](https://intel.threadlinqs.com/threat/TL-2026-2607) — medium — 2026-09-21 - [Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)](https://intel.threadlinqs.com/threat/TL-2026-2603) — high — 2026-09-21 - [indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()](https://intel.threadlinqs.com/threat/TL-2026-2590) — high — 2026-09-20 - [North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via…](https://intel.threadlinqs.com/threat/TL-2026-2581) — high — 2026-09-19 - [CVE-2026-90894 ("ParaShells"): Parallels Desktop for Mac Local Privilege Escalation via Appliance Extract…](https://intel.threadlinqs.com/threat/TL-2026-2536) — high — 2026-09-16 - [PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting](https://intel.threadlinqs.com/threat/TL-2026-2531) — high — 2026-09-16 - [SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2497) — critical — 2026-09-14 - [Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding…](https://intel.threadlinqs.com/threat/TL-2026-2484) — high — 2026-09-13 - [OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on…](https://intel.threadlinqs.com/threat/TL-2026-2459) — high — 2026-09-12 - [OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and…](https://intel.threadlinqs.com/threat/TL-2026-2332) — critical — 2026-09-04 - [Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks](https://intel.threadlinqs.com/threat/TL-2026-2299) — medium — 2026-09-02 - [Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception](https://intel.threadlinqs.com/threat/TL-2026-2294) — high — 2026-09-02 - [npm Supply-Chain Compromise: @7nohe/openapi-react-query-codegen Ships "Trinitite" Credential-Harvesting Worm](https://intel.threadlinqs.com/threat/TL-2026-2193) — critical — 2026-08-28 - [CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain…](https://intel.threadlinqs.com/threat/TL-2026-2151) — high — 2026-08-26 - [StepSecurity Dev Machine Guard adds fleet-wide developer credential inventory to close blind spot exploited…](https://intel.threadlinqs.com/threat/TL-2026-2160) — 2026-08-25 - [Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection](https://intel.threadlinqs.com/threat/TL-2026-2145) — high — 2026-08-25 - [GitHub Actions Supply Chain Attack: tj-actions & reviewdog Compromise (CVE-2025-30066, CVE-2025-30154)](https://intel.threadlinqs.com/threat/TL-2026-2130) — critical — 2026-08-24 - [14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2](https://intel.threadlinqs.com/threat/TL-2026-2099) — critical — 2026-08-21 - [Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2086) — critical — 2026-08-20 - [Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via…](https://intel.threadlinqs.com/threat/TL-2026-2085) — critical — 2026-08-20 - [Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-2083) — critical — 2026-08-20 - [Critical GitLab GraphQL Flaw (CVE-2026-19478, CVSS 9.4) Could Let Unauthenticated Attackers Delete Public…](https://intel.threadlinqs.com/threat/TL-2026-2048) — critical — 2026-08-17 - [AI Agents Persist Through Failed Malware, Rewrite Tools Mid-Attack: SentinelLABS Documents Sandbox Escape…](https://intel.threadlinqs.com/threat/TL-2026-2030) — high — 2026-08-16 ## Related CVEs CVEs referenced by the tracked threats that use T1195.001, most frequent first. - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) - [CVE-2026-48027](https://intel.threadlinqs.com/cve/CVE-2026-48027) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2023-48022](https://intel.threadlinqs.com/cve/CVE-2023-48022) - [CVE-2025-29927](https://intel.threadlinqs.com/cve/CVE-2025-29927) - [CVE-2025-30066](https://intel.threadlinqs.com/cve/CVE-2025-30066) - [CVE-2025-30154](https://intel.threadlinqs.com/cve/CVE-2025-30154) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-59536](https://intel.threadlinqs.com/cve/CVE-2025-59536) - [CVE-2025-64446](https://intel.threadlinqs.com/cve/CVE-2025-64446) - [CVE-2026-0257](https://intel.threadlinqs.com/cve/CVE-2026-0257) - [CVE-2026-10520](https://intel.threadlinqs.com/cve/CVE-2026-10520) - [CVE-2026-19478](https://intel.threadlinqs.com/cve/CVE-2026-19478) - [CVE-2026-19650](https://intel.threadlinqs.com/cve/CVE-2026-19650) - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2026-21852](https://intel.threadlinqs.com/cve/CVE-2026-21852) - [CVE-2026-65617](https://intel.threadlinqs.com/cve/CVE-2026-65617) - [CVE-2026-65921](https://intel.threadlinqs.com/cve/CVE-2026-65921) - [CVE-2026-65923](https://intel.threadlinqs.com/cve/CVE-2026-65923) - [CVE-2026-65924](https://intel.threadlinqs.com/cve/CVE-2026-65924) - [CVE-2026-65925](https://intel.threadlinqs.com/cve/CVE-2026-65925) - [CVE-2026-66014](https://intel.threadlinqs.com/cve/CVE-2026-66014) - [CVE-2026-90894](https://intel.threadlinqs.com/cve/CVE-2026-90894) ## Detection coverage Threadlinqs maintains 334 detection rules mapped to T1195.001 (SPL 125, KQL 106, Sigma 102, other 1). Rule content is available to Blue tier accounts and above; this page shows counts only. 334 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1195 Supply Chain Compromise](https://intel.threadlinqs.com/technique/T1195) — 333 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1195.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)