Supply Chain Attacks Really Are Surging

Hackers are doubling down on software supply chain attacks.

See Also: Top 10 Technical Predictions for 2025

Threat intelligence firm Cyble said such attacks occurred, on average, nearly 13 times per month last year, from February through September 2024. Starting in October, they surged to nearly 16 per month, staying steady into this year, before reaching nearly 25 attacks per month in April and May.

The firm’s research is based on its own investigations as well as open source intelligence, meaning it’s not complete; many attacks never get publicly reported. Even so, the direction of travel isn’t positive.

In the first five months of this year, Cyble said roughly two thirds of the 79 software supply chain attacks it documented directly targeted IT, technology or telecommunications firms. They are “rich potential targets for threat actors hoping to exploit downstream users.”

On a country level, 31 of the incidents targeted the United States, followed by Europe, with 27 incidents – of which 10 traced to France. In the Asia-Pacific region, the 26 incidents primarily hit India – accounting for nine incidents – followed by Taiwan with four incidents. Ten incidents targeted the Middle East and Africa, of which four each hit Israel and the United Arab Emirates.

Of the 24 sectors tracked by Cyble, 22 of them – all but mining and real estate – experienced at least one software supply chain attack.

The poster boy threat actor for financially motivated supply chain hacks is Russian-speaking Clop – aka Cl0p. “Damage from a successful exploit in those areas can be widespread, as happened with the hundreds of CL0P ransomware victims from a single vulnerability,” Cyble said.

The group has continued to find and exploit previously unknown flaws in managed file-transfer software, stealing data and holding it to ransom. The group’s attacks targeted users of Accellion FTA in 2021, Progress Software’s MOVEit in 2023 and Cleo Communications’ Harmony, VLTrader and LexiCom MFT software in 2024.

Other ransomware groups also continue to launch attacks against software and service providers that could have downstream implications.

A recent alert from the managed detection and response team at Sophos detailed a ransomware outbreak that traced to an attacker gaining access to a managed service provider’s remote monitoring and management tool, SimpleHelp. The attacker then used it to infect endpoints across the MSP’s clients with DragonForce ransomware, and also exfiltrated data and held it to ransom, in a classic double-extortion attack.

Recent software supply chain incidents have also featured the Hellcat group claiming in March to have stolen 44 gigabytes from Ascom, a Swiss provider of communication and collaboration solutions for healthcare and enterprises. Hellcat again in April claimed to have stolen 166 GB from China’s CVTE – aka Guangzhou Shiyuan Electronics – which manufactures consumer and commercial LCD display technology based in China. The Everest ransomware group in May asserted it stole 173 GB of data from Geneva-based banking software solution integrator ITSS in Switzerland.

As the hack of SolarWinds that came to light in 2020 memorably highlighted, nation-state attackers also target software supply chains.

Extended detection and response software vendor SentinelOne on Monday reported that it discovered that suspected Chinese attackers infiltrated an IT services and logistics company that it used to supply hardware to its employees. While SentinelOne said attackers don’t appear to have penetrated its network as a result, the incident had all the hallmarks of a nation-state attack, including the use of malware typically tied to Beijing-backed hacking groups (see: SentinelOne Sees No Breach After Hardware Supplier Hacked).

“At this point, it remains unclear whether the perpetrators’ focus was solely on the targeted IT logistics organization or if they intended to extend their reach to downstream organizations as well,” SentinelOne said. Still, the case “underscores the persistent threat posed by suspected Chinese threat actors, who have a history of seeking to establish strategic footholds to potentially compromise downstream entities.”

Other studies also point to an increase in hack attacks targeting software supply chains.

Verizon’s most recent Data Breach Investigations Report warned that third parties are an increasing risk factor. “We found third-party involvement of some sort in 30% of all breaches we analyzed, up from roughly 15% last year,” the report says of its assessment of 22,052 real-world security incidents that occurred across 139 countries from Nov. 1, 2023, through Oct. 31, 2024 (see: Verizon Reports Surge in Breaches Tied to Edge Devices).

For breaches featuring third-party involvement, in 81% of cases attackers perpetrated a system intrusion at the victim organization.

DBIR researchers said the repeat targeting of zero-day vulnerabilities in widely used products, such as Clop’s attack against users of Progress Software’s MOVEit managed file transfer application in May 2023, led them to expand their definition of third party involvement.

“Not every definition of third-party involvement in breaches would consider the usage of vulnerable software a third-party matter, but if you were in any other industry and a fundamental flaw was introduced in your supply chain due to defective raw materials or machinery, your organization would at the very least be sending a sternly worded letter to the supplier,” the report says.

Who’s at fault for poor quality along the supply chain is an issue at least as old as history. The DBIR report cites the well-known letter, written in the Old Babylonian period – circa 1750 B.C.E. – on a clay tablet, from Nanni to Ea-nasir complaining about the quality of copper ingots he delivered. “You have treated me with contempt,” reads a partial translation of the tablet, which Guinness World Records assesses to be the world’s oldest extant customer complaint.