Supply Chain Attack

What Supply Chain Attacks Are and Why They Are the Hardest To Detect

• A supply chain attack compromises an organization by attacking a trusted third party — a software vendor, open-source dependency, hardware manufacturer, or managed service provider — rather than attacking the target directly.
• MITRE ATT&CK maps this to T1195 (Supply Chain Compromise) with sub-techniques: T1195.001 (Compromise Software Dependencies and Development Tools), T1195.002 (Compromise Software Supply Chain), and T1195.003 (Compromise Hardware Supply Chain).
• The 2020 SolarWinds SUNBURST attack is the canonical example: Russian SVR threat actors injected malicious code into SolarWinds Orion platform updates.
• Over 18,000 organizations installed the trojanized update, and roughly 100 were targeted for follow-on exploitation including multiple U.S. federal agencies.
• Other major examples: the 2021 Codecov breach (attacker modified the Bash Uploader script, exfiltrating environment variables from CI/CD pipelines) and the 2023 3CX compromise (a double supply-chain attack where North Korean actors compromised a 3CX dependency, then used that access to trojanize the 3CX desktop app).

Detection Workflow — Supply Chain Compromise Triage

Step 1: Understand the Attack Surface

Supply chain compromise can enter through multiple vectors. The detection approach differs by vector:

Step 2: Collect Critical Log Sources

SPL query — detect new outbound connections from recently updated software:

index=windows sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| search Image IN ("*orion*", "*3cx*", "*agent*", "*update*")
| eval time_bucket = strftime(_time, "%Y-%m-%d")
| lookup software_update_timeline_lookup Image OUTPUT last_update_date
| where _time > last_update_date - 86400
| stats values(DestinationIp) as Destinations, values(DestinationPort) as Ports by Image, time_bucket
| where mvcount(Destinations) > 5
| eval alert = "HIGH — recently updated software making multiple outbound connections"

SPL query — detect dependencies resolved from unexpected package registries:

index=build sourcetype=ci_pipeline
| search stage="install" OR stage="dependencies"
| rex field=command "npm install (?<package>.*)"
| lookup npm_registry_lookup package OUTPUT expected_registry
| where registry != expected_registry
| stats values(registry) as ActualRegistry, values(package) as Package by build_id, repository

SPL query — detect CI/CD credential exfiltration (mass env dump):

index=ci sourcetype=vcs_audit_log
| search action="pushed" AND ref="codecov*" OR ref=".env*" OR ref="credentials*"
| eval tldr = "SUSPICIOUS — CI/CD credential exposure pattern"
| table _time, user, repository, ref, tldr

Step 3: Analyze Compromise Indicators

After a software update or dependency change, check these specific behavioral signals:

• New network connections to unusual destinations. SolarWinds Orion servers connected to api.solarwinds[.]com (normal) but also to C2 domains registered shortly before the attack and hosted on different infrastructure. Any software making connections to infrastructure not associated with its vendor is suspicious.
• Modified file timestamps. The malware inserted into SolarWinds Orion was compiled to match the timestamp of the legitimate build — zero anomaly on that dimension. But if the build environment is compromised, expect mismatched timestamps between the binary metadata and the CI pipeline log.
• Code-signing validity. SolarWinds Orion binaries were signed with the legitimate SolarWinds certificate, stolen from the build environment. A valid signature does not mean clean code. But an invalid signature on a software update is an immediate critical finding.
• Command-line anomalies in legitimate binaries. SUNBURST used svchost.exe -k patterns that were slightly different from normal. 3CX’s phone app made outbound network calls that looked like beaconing.
• Unusual process parent-child relationships. A monitoring tool spawning powershell.exe that then connects to the internet is abnormal — a potential insider threat or external compromise signal. A build tool accessing the Windows Registry or reading environment variables beyond its scope is suspicious.

PowerShell — verify code-signing certificates on suspect binaries:

Get-AuthenticodeSignature -FilePath "C:\Program Files\Vendor\update.exe" | Format-List
# Check: Status, SignerCertificate.Subject, SignerCertificate.NotAfter
# If Status is "NotSigned" or "HashMismatch" on an update binary — escalate

Step 4: Check for Second-Order Compromise

Supply chain attacks can cascade. A single compromised dependency can lead to multiple infected products:

• Check if your software vendor was listed as a supplier to other vendors you use
• Review the vulnerability disclosure: was the initial compromise in a transitive dependency?
• If your CI/CD pipeline downloaded a malicious package, check which builds consumed that package
• If a SaaS provider was compromised, check whether your tenant was accessed during the compromise window

Step 5: Determine Disposition

Recent Case Studies

Sicoob NuGet Package — Banking API Credential Theft via Supply Chain

In May 2026, researchers at Socket identified a malicious NuGet package named Sicoob.Sdk (versions 2.0.0 through 2.0.4) that masqueraded as a legitimate C# SDK for Sicoob, one of Brazil’s largest cooperative financial systems. The package was downloaded nearly 500 times before being blocked by NuGet.

The malicious functionality was activated when a developer instantiated SicoobClient with a client ID, PFX file path, and password. The package would read the PFX certificate from disk, Base64-encode it, and exfiltrate the client ID, PFX password, and encoded certificate to a hardcoded third-party Sentry endpoint. It also captured raw Boleto API responses, potentially exposing sensitive transaction details, payment status, amounts, and payer/payee data.

A critical supply chain deception vector in this attack was the source-to-package mismatch: the linked GitHub repository (Sicoob-Cooperativa) was kept clean, while the malicious data-stealing functionality appeared only in the package uploaded to NuGet. This made the package appear legitimate to developers who checked the repository.

The attack was amplified — albeit unintentionally — by Google Search AI Mode, which surfaced the malicious package as a legitimate C# library for interacting with Sicoob banking APIs. This demonstrates how AI-powered search tools can inadvertently direct developers to malicious dependencies.

Detection Signal: Review NuGet package integrity by cross-referencing package hashes against repository source. Monitor for unexpected Sentry DSN connections from build environments. Any package that exfiltrates PFX material or API credentials to third-party endpoints is compromised — regardless of how clean the linked repository appears.

GlassWorm — Developer-Focused Supply Chain Campaign With Resilient C2

GlassWorm is a persistent, well-resourced supply chain campaign targeting software developers since at least early 2025. In a takedown announced by CrowdStrike (in partnership with Google and Shadowserver), all four command-and-control channels associated with the operation were simultaneously neutralized.

The operation used a multi-pronged deployment strategy for supply chain compromise:

• Trojanized VS Code extensions published on both the Microsoft VS Code Marketplace and Open VSX, targeting users of VS Code forks including Cursor, Positron, Windsurf, and VSCodium
• Compromised npm and Python packages that introduced malicious code into developer environments
• Malicious Chrome extensions deployed post-compromise that collected screenshots, keystrokes, and clipboard content

The GlassWormRAT (a WebSocket-based JavaScript backdoor) harvested developer credentials — GitHub tokens, npm tokens, OpenVSX tokens, and cryptocurrency wallet files — enabling downstream compromise of CI/CD pipelines and package registries. Infected hosts were converted into covert SOCKS proxies, HVNC servers, and remote execution nodes via WebRTC, creating anonymized network access for the attackers.

What made GlassWorm technically notable was its resilient C2 architecture using four independent channels:

1. Solana blockchain memo fields as a dead drop resolver for C2 server addresses
2. BitTorrent DHT peer-to-peer network to retrieve configuration data
3. Google Calendar event titles as a dead drop resolver
4. Direct C2 connections hosted on commercial VPS providers

Cumulatively, the campaign poisoned more than 300 GitHub repositories using stolen developer credentials. Researchers at Endor Labs noted that the operators injected malicious code using Unicode normalization tricks that bypassed standard code review processes.

Detection Signal: Monitor VS Code extension behavior for unexpected network connections or file system access outside the extension’s declared scope. Audit GitHub repository commits for anomalous Unicode character usage. Check for unexpected Solana blockchain transactions from internal systems — these may be dead drop resolvers.

Preventative Controls

Related

• Kill Chain — covers the kill chain concepts
• API Attacks — OWASP API Top 10 — detection and response for T1190 techniques
• Container and Kubernetes Threats — detection and response for T1611, T1525, T1574.002 techniques
• JINX-0164 macOS Malware — research and intelligence summary of jinx-0164 — macos malware and fake recruiter lures targeting cryptocurrency firms
• GlassWorm / GREYVIBE Malware — research and intelligence summary of greyvibe — ai-powered cyberattacks targeting ukraine with custom tooling
• MITRE ATT&CK for Triage — covers the mitre att&ck for triage concepts
• TrapDoor: Multi-Registry npm, PyPI, Crates.io Campaign — how trapdoor supply chain attack spreads credential-stealing malware via npm, pypi, and cratesio attacks work and how to detect them
• Packagist PHP Supply Chain Attack — how packagist supply chain attack infects 8 packages using github-hosted linux malware attacks work and how to detect them
• Laravel-Lang 700+ Version Tag Poisoning — how laravel-lang php packages compromised to deliver cross-platform credential stealer attacks work and how to detect them
• Megalodon 5,561 Repo CI/CD Attack — how megalodon github attack targets 5,561 repos with malicious ci/cd workflows attacks work and how to detect them
• npm 2FA-Gated Publishing — how npm adds 2fa-gated publishing and package install controls against supply chain attacks helps detect and analyze threats

Sources

• CISA SolarWinds Advisory
• MITRE ATT&CK T1195
• Alex Birsan — Dependency Confusion
• CrowdStrike — Supply Chain Attacks
• SLSA Framework
• CISA — Securing the Software Supply Chain