What Is a Supply Chain Attack?
A supply chain attack targets the software, hardware, or service providers that organizations depend on rather than attacking the final victim directly. By compromising a single supplier, attackers can gain access to every organization that uses that supplier's products.
This approach is devastatingly effective because it exploits the trust relationships inherent in modern technology ecosystems. When a company installs a software update from a trusted vendor, security tools typically allow it through without scrutiny.
The SolarWinds Attack
In December 2020, the cybersecurity world was shaken by the discovery that Russian intelligence operatives had compromised SolarWinds, a company whose Orion network monitoring software was used by approximately 18,000 organizations including Fortune 500 companies and multiple US government agencies.
How it worked:
- Attackers gained access to SolarWinds' build environment, where software is compiled and packaged
- They inserted a backdoor called SUNBURST into a legitimate Orion software update
- The trojanized update was digitally signed by SolarWinds and distributed through normal update channels
- Approximately 18,000 organizations installed the compromised update
- The attackers selectively activated the backdoor in roughly 100 high-value targets, including the US Treasury, Department of Commerce, and cybersecurity firm FireEye
Why it was so effective:
- The malicious code was embedded in a trusted, digitally signed update
- The backdoor was designed to mimic legitimate Orion traffic, evading network monitoring
- Attackers used a two-week dormancy period before activating, avoiding detection during the critical post-update window
- The campaign operated undetected for approximately nine months
The Kaseya Incident
In July 2021, the REvil ransomware group exploited vulnerabilities in Kaseya's VSA remote management software, which is used by managed service providers (MSPs) to administer their clients' IT systems.
The cascade effect:
- Kaseya's software was used by approximately 40 MSPs
- Those MSPs collectively managed networks for over 1,500 downstream businesses
- By compromising one software platform, the attackers deployed ransomware across all of these organizations simultaneously
- Small businesses, dental offices, grocery stores, and schools were hit, many of which had no direct relationship with Kaseya
This attack demonstrated that supply chain compromises are not limited to nation-state espionage. Criminal groups use the same approach for financial gain.
Other Notable Supply Chain Attacks
- NotPetya (2017): Russian attackers compromised a Ukrainian accounting software called M.E.Doc, deploying destructive malware that spread globally and caused over $10 billion in damage
- Codecov (2021): Attackers modified a popular code coverage tool's bash uploader script, extracting environment variables and credentials from thousands of CI/CD pipelines
- 3CX (2023): A cascading supply chain attack where a compromised financial trading app led to the compromise of 3CX's desktop VoIP application, affecting 600,000 organizations
- MOVEit (2023): The Cl0p ransomware group exploited a zero-day in Progress Software's MOVEit file transfer tool, breaching hundreds of organizations including government agencies and major corporations
Why Supply Chain Attacks Are Increasing
Several factors drive the growth of this attack vector:
- Interconnected dependencies: Modern software relies on vast networks of third-party libraries, services, and tools
- Trust-based security models: Organizations grant extensive access to their vendors and suppliers
- High return on investment: Compromising one supplier yields access to thousands of targets
- Detection difficulty: Malicious code delivered through trusted channels evades most security controls
- Open-source risks: Popular open-source packages can be targeted, affecting millions of downstream applications
Defending Against Supply Chain Attacks
No single measure can eliminate supply chain risk, but layered defenses significantly reduce exposure:
- Vendor risk assessment: Evaluate the security practices of your critical suppliers before granting them access to your systems
- Network segmentation: Limit what vendor software can access within your network
- Zero-trust architecture: Verify every access request regardless of whether it originates from a trusted application
- Software bill of materials (SBOM): Maintain an inventory of all software components and their sources
- Behavioral monitoring: Deploy tools that detect unusual activity from trusted applications
- Update verification: Implement secondary validation for critical software updates where possible
The Personal Impact
Supply chain attacks often expose personal data at massive scale. When a payroll provider, healthcare platform, or file transfer service is compromised, the personal records of millions of individuals are affected through no fault of their own.
Check LeakedSource to monitor whether your personal data has been exposed through these large-scale supply chain breaches, because you may be affected without ever receiving a direct notification.