Loading story…
Two SC Media Perspectives columns argue that third-party and software supply-chain exposure is increasingly driving enterprise risk, citing examples such as Broadcom’s disclosure of exploited-in-the-wild VMware zero-days and the XZ Utils backdoor as reminders that upstream compromise or latent vulnerabilities can create broad downstream impact. The commentary frames this as an operational asymmetry: patching and validation cycles lag attacker exploitation timelines, making vendor and dependency risk harder to manage than credential- and phishing-driven intrusions.
Separately, Dark Reading reports that threat actors—particularly ransomware groups—are expanding use of bring-your-own-vulnerable-driver (BYOVD) techniques on Windows to gain kernel-level privileges and terminate security tooling (e.g., EDR processes) prior to deploying ransomware, infostealers, or backdoors. The article highlights that attackers have even abused a legitimate driver whose certificate was revoked years ago, underscoring persistent gaps in Windows driver trust and enforcement. Another SC Media commentary adds that mobile apps represent a structural supply-chain risk because they are publicly distributed and easily reverse engineered, and it flags 2026-era mobile threats such as AI introduced via third-party SDKs and growing urgency around post-quantum cryptography planning due to “harvest now, decrypt later” collection of encrypted data.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
An SC Media article argued that AI will accelerate both exploitation and defense, and recommended stronger third-party due diligence, zero-trust controls, and real-time exposure visibility to reduce supply-chain risk. The piece framed these measures as necessary responses to increasingly efficient exploit-driven attacks.
Dark Reading reported growing concern that ransomware groups and other threat actors are abusing bring-your-own-vulnerable-driver techniques to gain kernel access and disable security tools on Windows. Researchers and vendors called for stronger Microsoft defenses, including more frequent blocklist updates and tighter driver trust controls.
Recent VMware zero-day vulnerabilities were cited as examples of attackers increasingly using third-party software flaws to breach enterprises. The article notes that exploit code often appears quickly after disclosure, giving attackers an advantage over defenders.
An SC Media analysis identified five mobile security threats expected to shape 2026: unintended AI adoption through SDKs, post-quantum cryptography planning, scalable supply-chain compromise, privacy failures, and mobile apps as reconnaissance sources. It urged organizations to use mobile apps as early warning signals for broader enterprise risk.
The 2025 Verizon Data Breach Investigations Report documented broader trends showing third-party and supply-chain vulnerabilities, especially zero-days, playing a growing role in enterprise intrusions. The report was used to support claims that exploit-based compromise is becoming more common.
The XZ Utils backdoor incident emerged in late 2024, demonstrating how a widely reused open-source component could become a supply-chain compromise vector. The case was cited as a major example of software dependency risk.
Threat actors exploited zero-days in managed file transfer products including Fortra GoAnywhere and Cleo to steal data from organizations at scale. The incidents were cited as examples of how third-party software flaws can drive widespread enterprise compromise.
Microsoft enabled its Vulnerable Driver Blocklist by default starting with the Windows 11 2022 update, a defensive measure intended to prevent known exploitable drivers from loading. Later reporting criticized the blocklist for being updated too infrequently to keep pace with BYOVD abuse.
A legitimate EnCase driver from Guardian Software had a code-signing certificate that expired in 2010. Researchers later highlighted the driver as an example of how old signed drivers could still be abused in BYOVD attacks.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedarkreading.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Criminal and espionage-aligned actors are increasingly using **supply chain compromise** as a primary access strategy, chaining vendor breaches, open-source package poisoning, credential theft, and follow-on ransomware/extortion into a “self-reinforcing” cycle. Reporting on a Group-IB trends assessment described how compromises of software packages and third parties (including examples such as the **Shai-Hulud NPM worm**, package poisoning activity, and SaaS/OAuth abuse) are used to inherit trusted access into customer environments—particularly via high-leverage providers like **MSPs** and widely used business platforms (HR/CRM/ERP). The same reporting highlighted an expected acceleration in attack speed and scale as adversaries apply AI-assisted discovery across vendors and CI/CD pipelines, and a shift toward **identity-centric intrusions** that blend into normal user activity. Separate reporting described a large cross-platform campaign attributed to **“RU-APT-ChainReaver-L”** that used compromised distribution infrastructure—specifically file-sharing mirror services **Mirrored.to** and **Mirrorace.org** and hijacked GitHub repositories—to redirect users through deceptive chains and deliver **infostealer malware** signed with valid certificates and hosted via legitimate cloud services. Researchers tied the activity to credential theft observed on dark web markets and reported infrastructure at significant scale (100+ domains spanning redirectors, infection pages, and C2), with frequent tooling changes to evade antivirus detection. Other items in the set were general commentary on third-party risk, mobile-app supply chain exposure, and healthcare targeting trends, and did not provide additional, specific details about the same incidents beyond reinforcing that third-party and supply chain weaknesses are increasingly exploited for downstream compromise.
Jun 29, 2026
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026
Multiple critical zero-day vulnerabilities affecting Windows, Chrome, Apple devices, and popular enterprise software were actively exploited in December 2025, with attackers rapidly weaponizing newly disclosed flaws. Notable incidents included the exploitation of the React2Shell vulnerability in React 19, which was leveraged by a range of threat actors—from Chinese state-sponsored groups to North Korean-linked campaigns—deploying malware such as EtherRAT, PeerBlight, and BPFDoor. Emergency patches were released by vendors including Google and Apple, while Microsoft addressed an actively exploited Windows zero-day in its Patch Tuesday updates. The MITRE Top 25 Most Dangerous Software Weaknesses list for 2025 highlighted persistent coding errors that continue to be targeted by adversaries, emphasizing the need for secure development practices. Supply chain attacks also surged, with threat actors increasingly targeting GitHub Actions to compromise software development workflows. High-profile incidents such as the exploitation of Gogs and other open-source platforms underscored the risks inherent in collaborative coding environments. Security researchers and agencies like CISA responded by adding new vulnerabilities to their Known Exploited Vulnerabilities catalogs and urging organizations to prioritize patching and adopt a shared responsibility model for securing code repositories. The rapid pace of exploitation and the diversity of attack vectors reinforced the importance of agility, visibility, and proactive defense in enterprise cybersecurity strategies.
Jun 29, 2026