Supply-Chain Compromise: From Vendor Trust to Enterprise Impact

What this threat is

Supply-chain compromise means an attacker reaches you by first compromising something you already trust: a software producer, a package maintainer, a SaaS integration, a service provider. The attacker does not need to defeat your controls. The connection is already approved, often already privileged, and often exempt from the inspection you apply to strangers.

The scale is visible in breach data. In the Verizon Data Breach Investigations Report edition before the latest, the share of breaches involving a third party doubled to 30%. That report analyzed more than 22,000 security incidents and 12,195 confirmed breaches. The figure counts third-party involvement in breaches generally, so read it as a direction of travel, not a measure of the specific techniques in this brief.

Four trust paths, with documented cases

Each row below is a real, publicly documented incident or analysis. The last column is the question that decides whether an incident like it stays small.

TRUST PATH	DOCUMENTED CASE	WHAT THE ATTACKER GAINS	QUESTION TO ANSWER
Signed vendor update	SUNBURST: Orion updates were trojanized, signed by the vendor and posted to its official update site. The malware stayed dormant for up to two weeks and disguised its command traffic as legitimate Orion traffic.	Code execution on a privileged management platform, with that platform’s trust.	Which management platforms have broad reach and unrestricted outbound access?
Open-source dependency	The npm worm: more than 500 packages compromised. The malware searched for GitHub tokens and AWS, Google Cloud and Azure keys, then used stolen npm access to publish malicious versions of other packages.	Developer and pipeline credentials, plus self-propagation without further attacker effort.	Which build systems pull unpinned dependencies, and what cloud keys sit on developer machines?
Vendor-held integration token	Salesloft Drift: stolen OAuth tokens were used to export data from many customers’ Salesforce instances. A second set of tokens reached a very small number of Google Workspace accounts.	Customer data, and any secrets stored inside that data.	Which vendors hold tokens into our systems, and with what scope?
Vendor identity or device	A Microsoft Defender Experts case began with a compromised trusted vendor sending phishing; some recipient organizations automatically allowed vendor mail. In the Snowflake campaign, infostealer infections on contractor systems used for personal activity supplied credentials.	Trusted-sender status, or valid logins on a vendor-managed device.	Do we allow-list vendor mail wholesale, and do contractor devices meet our standard?

How one vendor becomes many victims: the Drift case

Google Threat Intelligence Group tracked the actor as UNC6395. Over roughly ten days, the actor used stolen OAuth tokens from the Salesloft Drift app to reach numerous corporate Salesforce instances and export large volumes of data. GTIG stated the issue did not come from a vulnerability in the core Salesforce platform.

The behavior was methodical. The actor ran count queries against Account, Opportunity, User and Case objects to gauge how much data each instance held, then pulled records in bulk and deleted its query jobs. Logs were not affected, so victims could still review them.

The more instructive step came after the export. The actor searched the stolen data for secrets: AWS access keys, passwords and Snowflake-related tokens. The search shows what attackers expect to find in support cases and CRM notes, and why GTIG told victims to scan their Salesforce objects for the same strings. Stolen customer data can become a route into customers’ cloud environments.

Containment needed the vendor and the platform owner together. Salesloft and Salesforce revoked all active access and refresh tokens for the Drift app, and Salesforce removed the app from its marketplace while the investigation ran. GTIG later widened its guidance: customers should treat any and all authentication tokens stored in or connected to Drift as potentially compromised. The original framing, a Salesforce integration problem, had been too narrow. That revision is the point. A vendor’s own scope statement can understate yours.

What we know, what we assess, what we do not know

Documented

Attackers used a signed vendor update, a self-propagating package worm and stolen integration tokens to reach customers without breaking their perimeters.
The npm worm harvested developer credentials and used them to spread. CISA advised reviewing dependencies, rotating developer credentials, requiring phishing-resistant MFA on GitHub and npm accounts, and removing unnecessary GitHub apps and OAuth applications.
Mandiant’s analysis of the signed-update attack advised treating signed vendor updates as a potential attack path, isolating management platforms and limiting their outbound connections, and rebuilding affected systems from known-good versions.

Our assessment

Shared dependencies and shared integrations give attackers leverage. One compromise of the Drift app reached many customers. One compromised maintainer account fed a worm that spread across hundreds of packages.
The paths most likely to hurt combine broad reach with weak visibility: a token with wide scope that nobody inventories, or a management platform that can talk to anything and is watched by nothing.
Vendor risk programs weighted towards questionnaires will rank vendors by posture. The attacker ranks them by what they can reach.

Not established by the sources used here

How many organizations can list every token and key a given vendor holds. No source quantifies this, so we make no claim about it.
Where the next compromise will occur. These cases show patterns of access, not predictions.

What should change

PRIORITY	CHANGE	WHY IT MATTERS
1	Map trust paths, not just vendors. For each important vendor, record four things: code or updates you ingest, tokens and API keys it holds into your systems, vendor accounts that can log in, and mail you trust automatically.	A vendor list shows who you pay. A trust-path map shows what an attacker inherits.
2	Tier by blast radius. Ask of each vendor: if it were compromised tomorrow, what could an attacker read, run or send as us?	It ranks vendors by consequence and can be answered without the vendor’s cooperation.
3	Shrink what each connection can reach. Scope integration tokens to the minimum, enforce IP restrictions on connected apps, and restrict outbound access from management platforms.	GTIG recommended limiting connected-app scopes and enforcing IP restrictions after the Drift incident. Mandiant made the same point about management platforms.
4	Pin and review dependencies, and protect developer identities. Lock versions, search for cached copies of affected packages, rotate developer credentials, and require phishing-resistant MFA on code and registry accounts.	These are the actions CISA listed for the npm worm.
5	Remove blanket allow rules for vendor mail.	Microsoft found that automatic allowing let a compromised vendor’s phishing bypass detection.
6	Look for secrets in business systems. Scan CRM, ticketing and support data for keys, passwords and tokens, and remove them.	The Drift actor searched exported data for exactly these.
7	Rehearse revocation. Be able to revoke every token and key tied to one vendor within hours, and treat a vendor’s breach notice as a trigger to widen scope, not narrow it.	GTIG widened its own scope guidance after the first advisory.

Where to apply this

Use this to prioritize vendor and dependency risk. A practical first exercise: list the five vendors whose compromise would hurt most, and for each one write down what it can run, hold, log in to and send as you. Wherever the answer is “we do not know,” start there.

Sources

CISA. Widespread Supply Chain Compromise Impacting npm Ecosystem (alert) cisa.gov
Google Threat Intelligence Group. Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
Mandiant. Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
Microsoft Threat Intelligence. Detecting and mitigating a multi-stage AiTM phishing and BEC campaign microsoft.com
Mandiant. UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Verizon. Data Breach Investigations Report (press release for the edition before the latest) verizon.com