# Supply-Chain Attack An intrusion that compromises its targets **indirectly, through a trusted supplier**. Rather than breaching a hardened organization head-on, the attacker subverts something the organization already trusts and installs — a software vendor's update, an open-source code library, a build server, a managed-service provider, or a hardware component — so the malicious payload arrives *inside* a legitimate, digitally-signed product. Because defenders trust their own vendors' updates, a single upstream compromise can silently infect thousands of downstream networks at once. Supply-chain attacks weaponize the *transitive trust* that modern software depends on. ## The SolarWinds canonical case The defining example is the **SolarWinds compromise**, discovered in December 2020. Attackers penetrated the build environment of SolarWinds and injected a backdoor (**SUNBURST**) into routine updates of its **Orion** network-management software. Roughly **18,000 customers** downloaded the trojanized update; the attackers then hand-picked a much smaller set — by U.S. accounts, around **nine federal agencies and roughly 100 private companies** — for deeper, follow-on intrusion. Victims included U.S. government departments and the cybersecurity firm FireEye, whose discovery of its own breach unraveled the campaign. In **April 2021** the U.S. and U.K. governments attributed the operation to Russia's foreign-intelligence service, the **SVR** — the intrusion set tracked as **APT29 / Cozy Bear** (also labeled Nobelium, UNC2452, Dark Halo). It was an espionage operation, not a destructive one: the goal was quiet, long-term access to high-value networks, exactly the kind of strategic intelligence collection that makes supply-chain compromise so attractive to state actors. Later incidents — the 2021 Kaseya ransomware outbreak, the recurring poisoning of open-source package repositories (npm, PyPI), and the 2024 *XZ Utils* backdoor near-miss — confirmed it as a dominant and growing class of threat. ## Right-wing-KB relevance Supply-chain attacks matter here as the **state-espionage counterpart** to the more politically-theatrical [[Hack-and-Leak Operation]]: where hack-and-leak is loud and aimed at swaying opinion, supply-chain compromise is silent and aimed at persistent access to government and infrastructure networks. SolarWinds illustrated both the reach of Russian intelligence against the U.S. government and the systemic fragility of a software ecosystem in which trust in vendors is effectively unverifiable. It also reframes the policy conversation toward *software provenance* and "zero trust" — anticipating the same provenance-and-authenticity problems this vault tracks around deepfakes and disinformation, but at the level of code rather than media. ## Distinct from neighbors - **[[Watering Hole]]** — compromises a *website the target visits*; a supply-chain attack compromises a *product the target installs and trusts*. - **[[Typosquatting]]** — tricks a user into a look-alike resource; supply-chain attack subverts the *genuine* resource itself. - **[[Hack-and-Leak Operation]]** — public influence operation; supply-chain attack is covert espionage/access. - **Third-party / vendor breach** — the broader category; a supply-chain attack specifically uses the supplier as the *delivery vector* into downstream victims. ## See Also - [[Cybersecurity Lexicon]] - [[Hack-and-Leak Operation]] - [[Watering Hole]] - [[Commercial Spyware]]