Supply chain attacks now fuel a 'self-reinforcing' cybercrime economy
Researchers say breaches link identity abuse, SaaS compromise, and ransomware into a cascading cycle
Cybercriminals are turning supply chain attacks into an industrial-scale operation, linking breaches, credential theft, and ransomware into a "self-reinforcing" ecosystem, researchers say.
In its latest trends report, Group-IB reckons individual strikes that lead to broader downstream compromises of businesses are now interconnected as cyberbaddies pursue multiple methods to breach vendors and service providers.
Supply chain hacks like the recent Shai-Hulud NPM worm, Salesloft debacle, or the OpenClaw package poisoning are fast becoming the primary goals of the criminal fraternity who try to exploit the inherited access to a victim's customers.
"Open source package compromise feeds malware distribution and credential theft," the research states. "Phishing and OAuth abuse enable identity compromise that unlocks SaaS and CI/CD environments. Data breaches supply the credentials, context, and relationships needed to refine impersonation and lateral movement. Ransomware and extortion arrive later in the chain, capitalizing on access and intelligence gathered earlier. Each stage strengthens the next, creating a self-reinforcing cycle of supply chain exploitation."
Over the next year, GroupIB predicts supply chain attacks will be executed faster thanks to AI-assisted tools that can scan for vulnerabilities across vendors, CI/CD pipelines, and browser extension marketplaces at machine speed.
It also expects to see traditional malware replaced by identity attacks, whereby criminals set themselves up as genuine users and their activity blends into the normal daily business functions, evading detection for longer periods.
Platforms offering HR, CRM, and ERP, as well as MSPs, are high-priority targets, Group-IB says, as a single compromise can lead to hackers gaining access to hundreds of customers.
Evolution of data breaches
The Salesloft breach, as well as the Oracle compromise of March 2025, are examples of how data breaches are shifting from a single-reward model to one where access is used for additional compromises.
Instead of taking one big wedge of data and demanding an extortion payment, criminals took their time to collect OAuth tokens and exploit misconfigured partner connections to move laterally. They then target downstream customers, steal their data and contact lists to repeat the cycle, or, in cases involving NPM and similar ecosystems, serve malicious updates to users to carry out fraud at scale.
"Cybercrime is no longer defined by single breaches. It is defined by cascading failures of trust," said Dmitry Volkov, Group-IB CEO.
"Attackers are industrializing supply chain compromise because it delivers scale, speed, and stealth. A single upstream breach can now ripple across entire industries. Defenders must stop thinking in terms of isolated systems and start securing trust itself, across every relationship, identity, and dependency."
Organizations should treat third parties as extensions of their own attack surface.
"Strategic investments in supply chain threat modeling, automated dependency checks, and data flow visibility are no longer optional – they are foundational to modern security architecture," said Volkov. ®