Threat actor playbooks: Who is targeting the IT supply chain & how
Opportunistic breaches are broad, often unsophisticated attacks that go after any vulnerable system, no matter who owns it. They rely on scanning for low-hanging fruit like misconfigured ports or unpatched software, hoping to land somewhere useful. In contrast, strategic attacks are deliberate, targeted intrusions. These are often carried out by Advanced Persistent Threats (APTs) or sophisticated cybercriminal groups aiming for long-term access, espionage, exfiltration, or systemic disruption. They can take months of quiet reconnaissance, custom malware development, and stealthy execution.
We have all seen the shift from random, opportunistic attacks to highly strategic supply chain intrusions. The SolarWinds breach immediately comes to mind. I actually spoke about it during an ISACA Houston event in November 2021.
These attacks are no longer just about quick financial gain. They’re about deep, persistent access, trust hijacking, and disrupting entire ecosystems.
In our hyperconnected world, where companies, vendors, MSPs, and integrators form the backbone of IT infrastructure, compromising one supplier can give attackers access to hundreds.
Real-world examples of strategic supply chain attacks
- SolarWinds (SUNBURST, 2020): Malicious code injected into Orion software updates gave attackers access to hundreds of downstream clients, including U.S. government agencies.
- 3CX Supply Chain Attack (2023): North Korea-linked actors compromised a VoIP software developer, using it as a pivot point into targets in crypto and aerospace.
- Kaseya (REvil, 2021): The breach of an RMM software vendor allowed ransomware to be deployed across thousands of SMBs, all via trusted software.
A glimpse of the perpetrators
Several nation-state APTs and criminal syndicates have adopted supply chain attacks as a core strategy. These actors don’t just attack systems, they target ecosystems.
Here are some of them:
- APT29 Cozy Bear (Russia): Tied to SolarWinds; known for deep reconnaissance, LOTL (Living Off the Land) tactics, and stealth
- Lazarus Group (North Korea): Behind the 3CX attack; blends espionage and financial motives
- Charming Kitten (Iran): Targets software developers and cloud platforms to reach dissidents and foreign entities
- REvil / Sodinokibi (Russia-linked): Used the Kaseya breach to scale ransomware delivery with precision
- Volt Typhoon (China): Focused on critical infrastructure and long-term access via software and telecom supply chains
Decoding their modus operandi: A view through the MITRE ATT&CK framework
Threat actors often follow a structured, multi-phase approach, well captured in the MITRE ATT&CK framework. Here are some of the key tactics and techniques often seen in software supply chain compromises:
| Tactic | Technique | What It Means |
|---|---|---|
| Initial Access | T1195 – Supply Chain Compromise | Injecting malware into legitimate vendor builds or updates |
| Execution | T1059 – Scripting/CLI | Using PowerShell, WMI, or shell scripts to run commands quietly |
| Persistence | T1543 – Modify System Process | Maintaining access via startup scripts or registry edits |
| Defense Evasion | T1027 – Obfuscation | Packing/encrypting payloads to hide from detection |
| Credential Access | T1003 – Dumping Credentials | Extracting passwords from memory (e.g., LSASS) |
| Lateral Movement | T1021 – Remote Services | Using RDP, SMB, or WinRM to spread within networks |
| Command and Control | T1071 – Application Protocols | Communicating with C2 over HTTPS or DNS tunneling |
| Exfiltration | T1048 – Alt Protocol Exfil | Using uncommon ports or encrypted channels to send stolen data |
| Impact | T1486 – Data Encrypted for Impact | Deploying ransomware or wipers to disrupt systems |
In more advanced scenarios, attackers tamper with the software build process itself (T1584.002 – Compromise Software Supply Chain). Real-world cases include the following:
- CCleaner (2017): Attackers modified the installer in their dev pipeline
- ASUS ShadowHammer (2018–2019): Malware was inserted into their trusted update utility
- XcodeGhost (2015): A trojanized version embedded malware into thousands of iOS apps.
Defending against invisible infiltration
Supply chain attacks are asymmetric in nature, compromising one trusted vendor can infect hundreds.
Here are key lessons for defenders:
- Zero trust isn’t optional: Assume breach, even from your own suppliers. Enforce tight access control and continuous validation.
- Monitor your CI/CD pipeline: Your build process and dependencies can become attack surfaces. Watch them like you would production systems.
- Supplier risk = cyber risk: Go beyond paper-based assessments. Demand technical evidence of controls, especially for third-party software.
- Behavioral analytics > Signature detection: These threats often use signed malware or novel techniques; anomaly detection is critical.
- Threat hunt, always: Constantly look for hidden threats across endpoint, identity, and network layers to find the sleeper implants before they activate.
Staying ahead of supply chain attacks
Supply chain attacks are no longer rare, they’re a go-to playbook for well-funded, well-resourced actors. Understanding how these attackers operate, especially through frameworks like MITRE ATT&CK, helps us build smarter defenses. As attackers move upstream, defenders must move closer to the trust boundary, where relationships, code, and updates converge.