10 Questions to Ask Suppliers as Part of Third-Party Security Reviews
Summary: Dragos reports that at least six of its designated threat groups - ALLANITE, CHRYSENE, DYMALLOY, HEXANE, RASPITE, and XENOTIME - have used supply chain attacks to gain initial access to target environments, citing SolarWinds as a prime example from the last 12-18 months. The firm notes that beyond software updates and patching, OEMs, vendors, and third-party contractors can provide ingress into ICS/OT environments through compromised or poorly secured direct network connections and remote access software, and that data leaked from a supplier - such as troubleshooting tickets - can be used in later attacks, a technique it attributes to groups like Conti.
Bottom line: Six tracked threat groups treat your supplier as the front door to your OT network, and the access they buy there - remote connections, vendor software, support tickets - is often the same access you granted for legitimate operations.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026