What kind of threat is this considered as?

An employee at a targeted company downloads an IoT software update from a vendor’s site that has been compromised with a Trojaned software update. What kind of threat is this considered as?
A. social engineering
B. inside threat
C. sophisticated actors threat
D. outside threat