Supply Chain Attack

Solorigate malware infection chain (Flowchart from Microsoft Security blog)

A Supply Chain Attack is when a threat actor makes use of unsecured network protocols, unprotected server infrastructures, or unsafe coding practices. The supply chain attacker breaks in, changes source codes, and hides malware in build and update processes.

Recent Attacks

Recently, criminals have targeted the following software vendors and IT services companies to infect their clients:
Kaseya
On July 2, hackers breached this Florida-based IT management software company. Kaseya specializes in monitoring and controlling the computer networks of “managed service providers” that sell their IT and cybersecurity services to hundreds of thousands of small- and medium-sized businesses. After the hackers infected 50 of Kaseya's managed service providers, they were able to enter the systems of those companies' 1,500 clients. The hackers encrypted the victims’ data and demanded US$50 million in exchange for the key.
SolarWinds
SunBurst Attack
In March 202, SolarWinds customers began experiencing a Russian-state-sponsored cyberattack that inserted a vulnerability called Sunburst into the Orion Platform (versions 2019.4 HF 5, 2020.2 unpatched, and 2020.2 HF 1). It allowed the attackers to compromise the servers running Orion products. The code was used in a targeted way to the extent that its exploitation required manual intervention. SolarWinds worked with CrowdStrike and KPMG to identify a component of Sunburst called Sunspot, which was responsible for injecting the Sunburst malicious code into the Orion Platform during the build process. Other components of the Sunburst malware chain include Teardrop and Raindrop. ''Asus & CCleaner
In July 2017, security analysts discovered Barium (aka ShadowHammer, ShadowPad, Wicked Panda), which is a Chinese hacker group that uses supply chain attacks as their core tool. They seed infections to many victims and then sort them to find espionage targets. This group infiltrated Asus and infected users through software updates and infected other users through CCleaner.
Maersk
In June 2017, NotPetya, a Russian hacker group's malware, spread by disguising itself as a legitimate software update. First, it hijacked Ukrainian accounting software and then seeded a worm that caused a record-breaking US$10 billion in damages around the world, including at the shipping company Maersk, which spent over a week on manually recovering its active directory. Target At Target, 70 million credit and debit card accounts were impacted between Nov. 27 and Dec. 15, 2013. The hacker, identified as “Profile 958,” was likely Ukrainian Andrey Hodirevski, and he used Scan4You to avoid detection by Target's mainstream virus-detection service. The files tested in Scan4You were also used to figure out where payment information was stored.