Using Cyber Threat Intelligence to Proactively Monitor Supply Chain Risk
Summary
The article recommends shifting supplier risk management from post-breach questionnaires and underground monitoring toward proactive CTI, using passive asset discovery and NetFlow to identify exposed services, unpatched vulnerabilities and suspicious supplier-network
Key points
- The article recommends moving beyond post-breach questionnaires and underground monitoring toward proactive threat reconnaissance of supplier networks.
- It suggests prioritizing suppliers by potential business impact, data sensitivity and the network access they have to an organization.
- Passive asset discovery can help identify exposed supplier systems, unpatched vulnerabilities and known exploited vulnerabilities without disrupting services.
- NetFlow analysis can be used to look for supplier network communications with known malicious infrastructure, including command-and-control systems.
- Examples of remote access ports to assess include SSH (22), RDP (3389), WinRM (5985 and 5986) and VNC (5900–590x).
- The article says traffic involving tools such as Cobalt Strike or ransomware precursors may warrant more urgent attention than generic IoT malware activity.
Article Details
- Topic
- Proactive cyber threat intelligence and external threat reconnaissance for monitoring third-party supply-chain exposure
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xss[.]is | Cybercrime forum identified as a venue where members offer compromised databases, credentials, or network access. |
MITRE ATT&CK
People
Threat Actors
ClopNamed as an extortionist operating data-leak sites that publish victim files if ransom is not paid.DragonForceNamed as an extortionist operating data-leak sites that publish victim files if ransom is not paid.ICE RELICThe source attributes the TeamViewer breach to the combined label “APT29/MidnightBlizzard” and describes the group as belonging to the Russian Foreign Intelligence Service (SVR).MidnightBlizzardThe source attributes the TeamViewer breach to the combined label “APT29/MidnightBlizzard” and describes the group as belonging to the Russian Foreign Intelligence Service (SVR).SandwormThe article says Sandworm breached M.E.Doc to launch the NotPetya wiper.
Malware
Vendors
AnyDesktools. Between mid-2024 and mid-2025, multiple RMM vendors have been breached, including TeamViewer, AnyDesk, ConnectWise, and BeyondTrust.In the RMM tool vendor’s public announcements, TeamViewer and ConnectWiseBeyondTrustand mid-2025, multiple RMM vendors have been breached, including TeamViewer, AnyDesk, ConnectWise, and BeyondTrust.In the RMM tool vendor’s public announcements, TeamViewer and ConnectWise assessed that they wereConnectWiseBetween mid-2024 and mid-2025, multiple RMM vendors have been breached, including TeamViewer, AnyDesk, ConnectWise, and BeyondTrust.In the RMM tool vendor’s public announcements, TeamViewer and ConnectWise assessedOktaSingle Sign-On (SSO) providers, such as Okta, which was breached during the HAR files incidentSolarWindsNetwork monitoring solution (NMS) vendors, such as SolarWinds who was also breached by the Russian SVRTeam Cymruthird-party risks effectively and complying with increasingly rigorous regulatory demands. One Team Cymru customer, who has the world’s largest supply chain, invested in building a team focused on ThreatTeamViewer(RMM) tools. Between mid-2024 and mid-2025, multiple RMM vendors have been breached, including TeamViewer, AnyDesk, ConnectWise, and BeyondTrust.In the RMM tool vendor’s public announcements, TeamViewer andTwilioAuthentication vendors, such as Twilio, which was breached during the SMS 2FA code theft incident
Products
Tools
Cobalt Strikevictim gateway IP addresses and IP addresses tagged as offensive security tools (OSTs) such as Cobalt Strike or malware families associated with ransomware precursor activities, would be considered a moreEvilWinRMPort 5985 and 5986 - Windows Remote Management (WinRM) HTTP/S: Regularly targeted for brute-force attacks. Access can be leveraged with publicly available hacking tools such as EvilWinRM on GitHub.