A Double Supply Chain Attack is an attack when an attacker targets two supply chain organizations in a sequence by intruding on only one vulnerable source. For example, if a software provider is compromised by the attackers and your organization uses that software, attackers could also infect and attack your organization to target your clients. In this scenario, the company who developed the software fell victim to the attack but by then all their clients who used this software were also breached.
A classic example of such an attack was seen in early 2023, when a VOIP provider 3CX fell victim to a software breach affecting both Windows and macOS. The application was compromised and attackers could infiltrate the network and exfiltrate data. Later, this was followed by another attack targeting all clients of 3CX. It is reported that Mandiant performed the investigation and discovered the chronology of events.
Although such an incident is rare, but is definitely possible. A robust Third-Party Risk Management (TPRM) is crucial and plays a major role in detecting and addressing such risks. Key points to consider when managing Third-Parties:
