The Anatomy of a Supply Chain Cyberattack

Anatomy of a Supply Chain Cyberattack 

Unlike typical cyberattacks, a supply chain infiltration requires more sophistication and patience than a script kiddie, phishing scam, or brute force attack. However, while it is still possible that a supply chain cyberattack may commence as a typical phishing scam, the sophistication of a supply chain infiltration comes into play after the initial intrusion. To successfully execute this type of attack, the actor must remain undetected in the organization's technology infrastructure and move across different software to access the systems where the victim's data or code resides. The level of sophistication required to stay hidden, combined with the prolonged waiting periods while surveying the systems and devising a compromise plan, leads to the inevitable conclusion that a nation-state actor often conducts such attacks.

An actor's restraint from arising suspicion while persistently accessing a vendor's software product over an extended period has its rewards. Disguised as legitimate software traffic, the actor gains entry to prospective victims' systems running the impacted version of the compromised product. The actor has now infiltrated a new host organization by leveraging the initial compromise, potentially leading to additional victims. And the value of this technique is not sheer volume. It essentially converts legitimate software into an unintended Trojan Horse by which the actor bypasses well-designed security protocols. In the case of SolarWinds, it was cybersecurity firm FireEye's investigation of its compromise that identified the backdoor built into SolarWinds' product. Here, the biggest challenge for the attacker is not the sophistication of the security defenses but the length of time before the compromise is widely detected. It is also worth noting that victims using the compromised software who do not sustain significant breaches likely evaded such fate simply because the attacker had prioritized other targets.