Trusted Developer Utilities Proxy Execution: JamPlus

Threat Actors may use JamPlus to proxy the execution of a malicious script. JamPlus is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.

ID: ATAGS-T1108.002
Sub-technique of:  ATAGS-T1108
Tactic: Defense Evasion
Targeted Components: Supply Chain
Responsibility: Provider
Created: 18 April 2026
Last Modified: 18 April 2026

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.