How to protect yourself from ‘Third-Party (Supply Chain) Cyber Attacks’ in a Connected World – 101

In our increasingly digital and interconnected world, supply chain attacks have emerged as a significant threat, targeting not just individual companies but entire digital ecosystems. These attacks take advantage of the complex network of interdependencies among businesses, especially software and IT vendors. By breaching a single weak link in the supply chain, cybercriminals can gain unauthorized access to sensitive information, leading to severe consequences such as data breaches, financial losses, operational disruptions, and damage to reputations across multiple organizations.

To bolster cybersecurity defenses and ensure the security and resilience of the entire third-party ecosystem, it is crucial to understand the nature, impact, and mitigation strategies of supply chain attacks.

The Escalating Threat of Supply Chain Attacks

Supply chain attacks exploit the networks, systems, and processes of an organization’s third-party vendors and suppliers. Cybercriminals use these entry points to infiltrate and compromise the target’s infrastructure. Once inside, they can inject malicious code, steal sensitive information, or disrupt operations, causing a ripple effect throughout the supply chain. A breach in one organization can have far-reaching implications, compromising the security of numerous entities. Consequently, attackers are increasingly targeting the supply chain as an efficient way to penetrate multiple organizations.

According to Capterra’s research, 61% of U.S. businesses experienced a software supply chain attack in the 12 months leading up to April 2023. Additionally, the number of cybercriminals advertising access to networks of service providers has grown steadily. In 2023, there were approximately 245,000 software supply chain attacks, costing businesses around $46 billion. This figure is expected to rise to $60 billion by 2025 as attackers continue to exploit service providers and their customers.

Motivations Behind Supply Chain Attacks

The motivations for these attacks are varied. The primary goal is often unauthorized access to specific systems or networks, which is easier to achieve by targeting the supply chain. These attacks allow cybercriminals to impact multiple organizations, exploiting intellectual property, financial data, customer information, and other confidential data for financial gain or competitive advantage.

While financial gain is a significant motivator, other objectives include cyber espionage, political agendas, and the theft of trade secrets and intellectual property. State-sponsored actors may seek access to classified information or national security secrets, while competitive industries might face threats to proprietary research and innovations.

Methods of Infiltration

Attackers use various methods to execute supply chain attacks, including:

Compromised Credentials

Cybercriminals often exploit the credentials of trusted vendors to access target organizations’ interconnected systems. These credentials can be acquired through various techniques or purchased on dark web forums. For example, Cybersixgill observed a post where a threat actor sold access to a major Chinese cloud provider’s networks, affecting clients such as Ferrari and Audi. Such breaches can lead to data theft, fraud, malware propagation, and ransomware attacks. Additionally, compromised providers can deliver manipulated software to clients, causing reputational damage, financial losses, legal issues, and operational disruptions.

Malicious Code Injection

Attackers also inject malicious code or malware into legitimate components, leading to a widespread infection chain. For example, in April 2024, a backdoor was discovered in the data compression utility XZ Utils, allowing attackers to gain unauthorized access and remote code execution. This malicious code affected several widely used Linux distributions, including Kali Linux, Fedora, Debian, and Arch Linux. The backdoor was inserted by an individual who had gained the trust of the XZ Utils project maintainers over two years, causing extensive damage.

Exploiting Vulnerabilities

Exploiting vulnerabilities in software, hardware, or processes is another effective method to launch supply chain attacks. In June 2023, three critical SQL injection vulnerabilities were discovered in Progress Software’s MOVEit Transfer platform, affecting around 1,700 organizations. The Cl0p ransomware gang exploited these vulnerabilities in a widespread attack, targeting companies such as Zellis, British Airways, the BBC, and the Minnesota Department of Education. This led to unauthorized access to sensitive information, including personal and financial details.

Lessons from Major Incidents

High-profile supply chain attacks, such as those on SolarWinds, Kaseya, and NotPetya, highlight the devastating potential of these breaches. The SolarWinds attack involved inserting a backdoor into software updates, which were then distributed to thousands of clients, including government agencies and major corporations. This incident underscored the need for rigorous security measures for software supply chains and the importance of constant vigilance and rapid response capabilities.

Strategies for Mitigation

Given the severe implications of supply chain attacks, organizations must adopt proactive measures to mitigate risks. The right tools, intelligence, and context help security teams understand specific threats to their organization. Cybersixgill’s Third-Party Intelligence module provides enhanced cyber threat intelligence from various sources, offering critical insights into suppliers’ cybersecurity gaps. This enables security teams to:

• Anticipate supply chain threats
• Continuously assess third parties’ security postures to minimize risk
• Report threats and recommend remediation actions to affected vendors
• Conduct due diligence in mergers and acquisitions before finalizing contracts

Conclusion

In today’s evolving cyber threat landscape, securing the supply chain is not just a strategic priority but a fundamental necessity to ensure the integrity and reliability of digital operations. The growing threat of supply chain attacks demands heightened awareness and strong security strategies from all stakeholders. As business ecosystems become more interconnected, the vulnerabilities within supply chains become more apparent and exploitable. Organizations must implement comprehensive security measures, continuously assess their third-party relationships, and stay updated on the latest threats to safeguard their digital ecosystems.