Supply Chain Attacks: How They Work, 8 Real Examples and How to Prevent Them
CyberRank Research
A supply chain attack is a cyberattack that compromises a trusted supplier, product or service in order to reach that supplier's customers. Instead of breaking into each target directly, the attacker tampers with something the targets already trust, such as a software update, an open-source package, a managed service connection or a file-transfer platform, and lets that trust carry the attack downstream. CyberRank helps buyers see the outside-in conditions these attacks exploit, such as exposed vulnerable software, leaked credentials and breach history, across every supplier, reassessed nightly.
TL;DR
- Supply chain attacks abuse trust: signed updates, popular packages, managed service tools and shared platforms.
- ENISA found that around 62% of analysed attacks exploited customers' trust in their supplier and about 66% targeted the supplier's code.
- Famous cases (SolarWinds, Kaseya, MOVEit, 3CX, XZ Utils, Shai-Hulud) each teach a different control lesson.
- Prevention is shared: buyers inventory and tier suppliers, verify what they install, limit vendor access and monitor for change; vendors secure their build and release pipeline.
- CyberRank gives buyers the independent outside-in view: it rates every supplier from public signals, maps their own suppliers, and reassesses monitored vendors nightly so newly exposed vendors surface quickly.
What is a supply chain attack?
ENISA describes a supply chain attack as a combination of at least two attacks: one on a supplier, then one on the supplier's customers, using the access gained in the first. The supplier is rarely the final target; it is the delivery mechanism.
NIST defines an ICT supply chain compromise as an occurrence in which an adversary jeopardises the confidentiality, integrity or availability of a system or its information, and notes that it can happen anywhere in the system development lifecycle (NIST SP 800-161).
Supply chain attacks are the sharpest form of third-party risk, as explained in detail in our article about third-party risk management.
Why do supply chain attacks work?
Supply chain attacks work because customers are built to accept what trusted suppliers send them.
Signed updates pass endpoint checks, approved SaaS integrations hold standing access, and dependencies arrive automatically through package managers. ENISA's analysis of 24 attacks between January 2020 and early July 2021 found:
| Finding (ENISA, 2021) | Share |
|---|---|
| Attacks on customers that exploited their trust in the supplier | Shareabout 62% |
| Incidents where attackers targeted the supplier's code | Shareabout 66% |
| Attacks where malware was the technique | Shareabout 62% |
| Attacks aimed at customer data (including personal data and IP) | Shareabout 58% |
| Suppliers that did not know, or did not report, how they were compromised | Shareabout 66% |
Why an independent view of suppliers matters
If two in three compromised suppliers could not say how they were compromised, buyers cannot rely on supplier reporting alone. That is the gap CyberRank is built for: an independent, outside-in view of every supplier's posture that does not depend on the supplier telling you anything.
What are the types of supply chain attacks?
The main types target software builds and updates, open-source packages, managed service tools, shared platforms, other supply chains (cascading attacks) and third-party access.
| Type | How it works | Example | How CyberRank helps |
|---|---|---|---|
| Software build and update | How it worksMalicious code is inserted into the vendor's build or update process and shipped as a signed release | ExampleSolarWinds Orion | How CyberRank helpsCannot see inside a build server; impact tiers and the fourth-party view show which critical vendors to contact first |
| Open-source package and dependency | How it worksA malicious version of a package is published to a public registry and pulled into downstream builds | ExampleXZ Utils, Shai-Hulud (npm) | How CyberRank helpsVulnerability signals on vendors' internet-facing systems show where known-vulnerable software is exposed after disclosure |
| Managed service and remote management | How it worksAttackers abuse a provider's administrative tools to reach every customer | ExampleKaseya VSA | How CyberRank helpsScans each vendor's main domain and a minimum of 50 subdomains for exposed, vulnerable services |
| Shared platform vulnerability | How it worksA flaw in a widely used product is exploited across its customer base | ExampleMOVEit Transfer | How CyberRank helpsNightly reassessment gives a starting list of exposed vendors when a flaw is disclosed |
| Chained (cascading) supply chain | How it worksOne supply chain compromise is used to launch another | Example3CX via X_Trader | How CyberRank helpsMaps fourth parties and combines supply-chain risk at distance 1 and 2 |
| Third-party access | How it worksStolen vendor credentials are used to enter the customer network | ExampleTarget via HVAC contractor | How CyberRank helpsChecks each vendor for leaked staff credentials and raises an event when new ones appear |
What are 8 real supply chain attack examples?
Target, SolarWinds, Kaseya, Toyota, MOVEit, 3CX, XZ Utils and Shai-Hulud are the most cited examples of supply chain attacks, and each teaches a different control lesson. The last column shows what CyberRank would show a buyer for each.
| Incident | Year | Vector | What happened | Lesson | How CyberRank helps |
|---|---|---|---|---|---|
| Target | Year2013 | VectorVendor credentials | What happenedAttackers used credentials stolen from a refrigeration and HVAC contractor to enter Target's network and reach payment systems | LessonLimit and segment vendor network access | How CyberRank helpsLeaked-credential checks per vendor flag suppliers whose staff credentials are exposed, the entry point used here |
| SolarWinds Orion | Year2020 | VectorSoftware build | What happenedMalicious code inserted into Orion updates, which were signed and distributed to customers; SolarWinds estimated that fewer than 18,000 customers installed affected versions | LessonA valid signature does not prove a clean build | How CyberRank helpsNo outside-in tool can see inside a build server; impact tiers and fourth-party mapping show which critical vendors to contact first once a compromise is disclosed |
| Kaseya VSA | Year2021 | VectorManaged service tooling | What happenedA vulnerability in a remote management platform used by managed service providers was exploited to push ransomware to downstream businesses | LessonOne MSP tool can reach many small firms at once | How CyberRank helpsScans the main domain and a minimum of 50 subdomains of each vendor for exposed, vulnerable internet-facing software, re-checked nightly for monitored vendors |
| Toyota and Kojima Industries | Year2022 | VectorSupplier disruption | What happenedToyota suspended domestic factory operations for a day after a parts supplier was hit by a suspected cyberattack | LessonOperational dependency is supply chain risk too | How CyberRank helpsCombines each vendor's rating with your impact tier, so critical suppliers with weak posture stand out on the heat map |
| MOVEit Transfer | Year2023 | VectorShared platform zero-day | What happenedA SQL injection zero-day in a managed file transfer product was exploited for mass data theft across its user base | LessonFile-transfer and integration platforms concentrate risk | How CyberRank helpsNightly reassessment and new-breach events give a starting list of affected vendors, as in our PHP2Shell analysis |
| 3CX | Year2023 | VectorChained compromise | What happenedA trojanised trading application installed by an employee led to 3CX's own signed desktop software being weaponised | LessonYour supplier's suppliers can start the chain | How CyberRank helpsShows your vendors' own suppliers (fourth parties) with ratings and combines supply-chain risk at distance 1 and 2 |
| XZ Utils | Year2024 | VectorOpen-source maintainer | What happenedA backdoor was introduced into a widely used compression library after long-term social engineering of the project; it was caught before broad release | LessonMaintainer trust is an attack surface | How CyberRank helpsOutside-in checks cannot see inside an open-source library; after disclosure, vulnerability signals help show which vendors may expose known-vulnerable software |
| Shai-Hulud (npm) | Year2025 | VectorSelf-replicating package worm | What happenedCISA reported a worm that compromised over 500 npm packages by authenticating as compromised developers and publishing malicious versions | LessonRotate developer credentials, pin versions, require phishing-resistant MFA | How CyberRank helpsLeaked-credential checks flag vendors whose staff credentials appear in known leaks, the kind of access this worm abused |
How do you prevent supply chain attacks?
No single control stops supply chain attacks. Supply chain attack prevention and mitigation means applying cybersecurity supply chain risk management across the whole relationship, as CISA and NIST recommend: know critical suppliers, assess and monitor them throughout the relationship, and plan for the full lifecycle.
If you buy software and services
- Inventory and tier your suppliers. You cannot protect against what you do not know you depend on. Rank suppliers by what stops if they fail and what data they hold.
- Assess before you onboard, then keep watching. Use an outside-in assessment for a first view and a questionnaire for controls you cannot see. Re-check critical vendors when news of a new vulnerability or breach breaks.
- Limit standing access. Give vendors least-privilege, time-bound access with MFA; review OAuth and API integrations on a schedule, because access granted at onboarding tends to outlive the need.
- Verify what you install. Check signatures and hashes, request SBOMs for critical software, and pin dependency versions.
- Segment and monitor. Restrict where vendor software can connect and alert on unexpected outbound traffic from trusted tools.
- Plan for supplier failure. Write failover steps for critical software and include key suppliers in incident exercises (NIST CSF 2.0 GV.SC-08).
If you supply software and services
- Harden the build pipeline. Protect code repositories, build systems and signing keys at least as strongly as production.
- Publish integrity evidence. Provide hashes, signed releases and SBOMs so customers can verify what they receive.
- Manage your own suppliers. Apply the same due diligence to your dependencies and subprocessors that your customers apply to you.
- Disclose quickly and clearly. Tell customers what happened, what is affected and what they should do.
Where CyberRank fits in prevention
Each buyer step above maps to a CyberRank feature, and you can start today with a free CyberRank security rating of any supplier:
- Inventory and tier: add every supplier by domain or company name and give it an impact tier; the heat map shows critical-but-weak suppliers first.
- Assess and keep watching: an AAA–D rating in minutes, then nightly reassessment with events for rating changes, new data breaches and privacy-policy changes.
- Limit standing access: leaked-credential checks show which suppliers' staff credentials are exposed, so you know whose access to review first.
- Verify what you install: outside CyberRank's scope. Use signatures, hashes and SBOMs for this step.
- Your suppliers' suppliers: CyberRank maps fourth parties and their ratings, so a chained attack like 3CX does not start entirely out of sight.
What can outside-in assessment show about supply chain risk?
An outside-in assessment cannot see inside a vendor's build server. It can show the conditions that make a vendor easier to compromise and slower to respond.
Those conditions include exposed and outdated internet-facing software, known vulnerabilities on subdomains, weak or missing DMARC, leaked employee credentials, breach history, and which other providers the vendor depends on. Those signals help you decide which vendors to question first when a new supply chain incident breaks.
What outside-in detection can and cannot do is explained in detail in our article about detecting a supply chain attack from outside a vendor.
How CyberRank helps
CyberRank assesses vendors from public signals, covering the main domain and a minimum of 50 subdomains, plus vulnerabilities, email security, leaked credentials, data breaches, certifications and the vendor's own suppliers (fourth parties). Monitored vendors are reassessed nightly, and CyberRank raises an event when a rating changes, a new data breach appears or a privacy policy changes.
When a widely exploited flaw is disclosed, that gives you a starting list of vendors to contact. Our analysis of the PHP2Shell vendor exposure shows this workflow in practice.
Conclusion
Supply chain attacks succeed because trust travels faster than verification. Reduce the blast radius by knowing which suppliers matter, limiting what they can reach, verifying what they ship and watching for change between reviews. For the programme around these controls, start with our third-party risk management guide.
CyberRank covers the watching part: an independent rating of every supplier, their own suppliers and their exposure, refreshed nightly.
Sector guides: vendor risk management for banks, for healthcare, for government and SOEs, and for listed companies.
References
- ENISA, Threat Landscape for Supply Chain Attacks (2021)
- ENISA, Understanding the increase in Supply Chain Security Attacks (press release)
- CISA and NIST, Defending Against Software Supply Chain Attacks
- CISA, Widespread Supply Chain Compromise Impacting npm Ecosystem (23 September 2025)
- NIST, SP 800-161 Rev. 1 (update 1)
- NIST, CSF 2.0, CSWP 29
Quick answers
Short, direct answers to questions this article raises.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating