Exorcist

Advanced Persistent Threats based on Supply Chain Vulnerabilities: Challenges, Solutions and Future Directions

“…In complex systems, this diversity of techniques tends to expose more attack surfaces, making the system susceptible to potential exploitation. A notable example of this is the exploitation of the Cyber Supply Chain (CSC), which has become increasingly prevalent for APT actors [5], [12], [18]. The use of the Kill Chain model and the understanding of its evolution have significantly contributed to the identification and detection of APTs.…”

“…In order to explicitly illustrate the meaning and context of each stage, we primarily refer to tactics defined in the MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) framework 5 . To the best of our knowledge, MITRE provides a more comprehensive definition of techniques, tactics, and procedures (TTPs) for various attack types.…”

“…a) Software Dependencies and Development Tools: The development of software invariably relies on external libraries or tools aimed at accelerating the entire process and ensuring quality. However, this opens up opportunities for adversaries to compromise the developed software through their dependencies, including widely used open-source or closed-source projects [5], [13], [50]. Moreover, these popular projects may be extensively distributed to a wide consumer base, potentially affecting millions of individuals or institutions.…”

“…Since the exposure of the SolarWinds supply chain attack in 2020 [4], there is a broader tendency to exploit SCVs. Due to the stealthy and massive impact of the supply chain [5], the supply chain-based APT has exacerbated the security situation. Hence, developing efficient and powerful defense products and their deployments has become an urgent priority.…”

“…Notably, the related survey [11] on APTs fails to mention supply chain attacks. On the other hand, works that focus on supply chain attacks lack in-depth analysis of advanced exploitation techniques [5], [12]- [15]. It is important to recognize that most supply chain attacks are non-targeted, distinguishing them from targeted APTs.…”