Cyber Risk & Your Supply Chain: Managing the Growing Threat

Credentials Theft: By using social engineering attacks (e.g., phishing, vishing), threat actors can trick employees into sharing their login credentials. Once a threat actor gains access to a supplier’s network using stolen credentials, they can leverage that access to infiltrate the target business’ network, circumventing its security defenses.

Software Infection: Threat actors may also use infected software to execute attacks—either by compromising the software development or the software distribution process—and inserting malicious code or backdoors into the software. This allows them to gain access to systems or networks of the software users, and steal data, disrupt operations, or cause damage.

Watering Hole Attack: A watering hole attack targets groups of organizations in a supply chain by injecting malicious code into websites that they commonly visit. The malicious code redirects users to a compromised website that hosts the threat actor’s malware. A watering hole attack is different from social engineering attacks, which trick users into clicking on malicious links or attachments. Instead, a watering hole attack takes advantage of users’ trust in the legitimate websites they usually visit.

Malware: Often introduced through attack vectors like those discussed above, malware may be used to further supply chain attacks. Threat actors may infect the devices or systems of one party in a supply chain, using malware to steal data or spy on activities that they use to infiltrate their end target in the supply chain. Supply chain attacks may also include denial of service attacks that knock a business offline or ransomware attacks that hold the victim’s data hostage until a ransom is paid.