Supply Chain Threats to Industrial Control: Third-Party Compromise
Summary: Dragos describes third-party compromise as an attack vector that bypasses a company's usual firewall, proxy, and email defenses by exploiting implicit trust between organizations and their suppliers, integrators, and contractors. It cites the M.E.Doc compromise in Ukraine, where attackers weaponized an accounting software update with NotPetya, which used exploits from WannaCry along with Mimikatz credential capture and PSExec remote execution, spread to adjacent subnets and business partners, and cost FedEx $300 million while crippling Maersk even though neither was a direct target.
Why it matters: FedEx's $300 million loss and Maersk's disruption came from malware that reached them through a trusted software supplier, not through any direct attack on their own networks. The article notes the same trust relationships exist in ICS environments, where a compromised contractor credential or code signing certificate can carry an adversary into power plants and plant floors with far more serious impact.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026