In last week's article we explored the main cyber risks associated with the Supply Chain and potential solutions.
This week, we will focus on some of the most significant incidents involving the Supply Chain, whose devastating effects had widespread consequences across industries and organizations worldwide.
Notable Supply Chain Cyber Incidents
- MOVEit (June 2023): This supply chain attack targeted users of MOVEit, a Managed File Transfer (MFT) software owned by U.S.-based Progress Software. MOVEit is designed to securely transfer sensitive files and is widely used, particularly in the United States. The attackers compromised more than 2,600 organizations, including high-profile names like the BBC, British Airways, Ernst & Young, Boots, and Aer Lingus. Personally identifiable information (PII) exposed in the attack included identity documents, addresses, birth dates, and national insurance numbers. Since then, a patch has been released, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory urging users to install the update to prevent further breaches. The Cl0p ransomware group has been linked to the attack, exploiting MOVEit’s exposed web interfaces (EWI) to cause significant harm. EWIs can pose a major security risk, as they can be manipulated by attackers to extract sensitive data or inject malware if left unsecured. This incident highlights how quickly a supply chain attack can escalate and demonstrates how even smaller suppliers can have a significant impact on large enterprises and multinational organizations.
- Log4j (December 2021): In late 2021, Log4j, a widely used Java-based logging utility, was exposed to a zero-day vulnerability known as Log4Shell, which put millions of devices at risk worldwide. Developed by the Apache Software Foundation, Log4j is an open-source software that logs diagnostic information from systems and communicates it to users and administrators. However, the Log4Shell zero-day vulnerability, discovered in December 2021, allowed cybercriminals to infiltrate systems, steal data, gather login credentials, and install additional malware. Given Log4j's widespread use, this incident exposed a vast number of individuals and organizations to attack risks. Among the affected entities were the Belgian Ministry of Defense, which reported an attack in mid-December, and the Vietnamese cryptocurrency platform Onus, which used a vulnerable version of Log4j.
- Kaseya (July 2021): This attack, which occurred in July 2021, was attributed to REvil (or Sodinokibi), a notorious Russian-based ransomware-as-a-service (RaaS) group responsible for several high-profile attacks on organizations globally. Kaseya, an IT management company serving Managed Service Providers (MSPs) and small to medium-sized businesses (SMBs), operates in 10 countries. Among its offerings is the Virtual System Administrator (VSA), a unified tool for remote monitoring and network management. During the incident, REvil exploited a zero-day vulnerability in VSA to deploy ransomware to multiple managed service providers and their clients, causing widespread service disruptions and significant financial losses. Estimates suggest that between 800 and 1,500 small to medium-sized businesses were impacted through their MSPs, underscoring the potential downstream effects of supply chain attacks.
- SolarWinds (December 2020): SolarWinds, a prominent U.S. software company, provides solutions to help organizations manage their networks, systems, and IT infrastructure. The attack on SolarWinds, which occurred at the end of 2020, was attributed to a sophisticated cyber group known as APT29 or Cozy Bear, believed to be sponsored by the Russian government and linked to Russia's Foreign Intelligence Service (SVR). The incident involved the compromise of SolarWinds' Orion software, which was subsequently used to distribute a malicious backdoor (SUNBURST) to numerous organizations. Victims included several U.S. government agencies and a substantial number of private companies. The attackers leveraged this backdoor to access sensitive data, conduct espionage, and maintain persistent access to compromised networks.
Lessons Learned
These Supply Chain attacks reveal critical lessons for the organizations:
- Timely Patching and Continuous Monitoring: The MOVEit attack clearly underscores the importance of keeping software up to date and applying patches immediately after vulnerabilities are discovered. However, most companies are still far behind in applying these patches to avoid these types of attacks. This risk can be mitigated with automated patch management solutions and an elaborate vulnerability scanning procedure. All that said, monitoring these exposed web interfaces (EWI) or other external-facing systems is also a critical component for early detection and response to potential exploits before they escalate into full-blown attacks.
- The Impact of Open Source: The Log4j vulnerability highlighted the depth with which open-source technology has been laced into the fabric of our technology environment. Widely used across industries, open-source tools such as Log4j are very often the workhorses behind some of the most mission-critical operations. While open-source software allows for flexibility and community-driven innovation, it also introduces unique risks. Organizations need to ensure that there are processes in place to track and manage open-source components used; this should include regular vulnerability assessments and a subscription to the alerts of relevant security advisories. Contingency plans must be made for the scenario where a critical vulnerability is found.
- The IT Supply Chain Attack Ripple Effect: The Kaseya incident further elaborated that from an attack on a single vendor, the effect could reverberate across hundreds if not thousands of downstream organizations. Small and medium-sized businesses can be especially affected by such attacks because they often rely upon managed service providers. That would only underscore the importance of thorough vetting of third-party vendors and service providers at onboarding, as well as during continuous risk assessment. This should make organizations demand better security standards from their vendors, with exercises such as regular audits to assure their compliance.
- The Persistent Threat of Nation-State Attacks: The SolarWinds attack made clear the persistent threat posed by nation-states as actors and the complexities involved in their defense against such Advanced Persistent Threats. These attacks are not only opportunistic but usually form part of a long-term espionage campaign to get access to sensitive information and to have a stronghold within the networks for longer periods. Organizations need to adopt a zero-trust security model: The current cybersecurity architecture has to be revised so that organizations implement a zero-trust security model—meaning that it is assumed that no user, device, or application is trusted within the network perimeter by default. The key elements of this approach are multi-factor authentication, micro-segmentation, and continuous monitoring of atypical activities.
- Improving Incident Response and Crisis Management: Each of these major incidents underlines the importance of having a robust incident response plan. Organizations are encouraged to regularly test and update their procedures for incident response so that they are prepared for a wide range of attack scenarios. In addition to the technical response, there should be an outlined response regarding communication to manage stakeholders, including customers, partners, and regulators, in a time of breach. Companies who respond in a clear and timely manner to an incident are far more likely to retain the trust of their customers and to limit reputational damage.
- Collaboration and Information Sharing: These incidents further underwrite the need for close collaboration between organizations, governments, and security researchers. The sharing of threat intelligence could make it easier to identify emerging risks and expedite responses to new vulnerabilities. Industry groups and cybersecurity alliances can play a critical role in making such collaboration effective, ensuring that information flows quickly and accurately to the right parties. Similarly, governments should support such actions by adopting frameworks that will encourage public-private partnerships and foster the sharing of information securely without a reputation risk.
- The importance of a Cybersecurity Culture: The requirement of a cybersecurity culture within an organization has become very important. It is no more about having the right tools in place, but rather how every employee is aware of his role in maintaining security. Training programs that instruct employees to recognize phishing attacks, process sensitive information correctly, and notify on suspicious behavior are equally important as the technical barriers implemented. Leadership also must support cybersecurity as a business imperative by working to ensure that security objectives are well-aligned with overall business goals.
A Call to Action
The risk and concerns around cyber threats in Supply Chain continue to rise.
As the above examples illustrate, no one is immune from this kind of attacks and the consequences can be far-reaching.
Organizations should therefore adopt a proactive and multi-layered approach to cybersecurity that includes strengthening vendor risk management practices, investing in cutting-edge detection and response technologies, and fostering a culture of security awareness.
Stay Cyber Safe!2,600
