Supply-Chain and Signed Malware

• Instead of attacking you directly, compromise something you trust and already run.
• SolarWinds (2020): malicious code (SUNBURST) inserted into a signed Orion software update, pushed to thousands of orgs. Trusted, signed, auto-installed.
• XZ Utils (2024, CVE-2024-3094): a long-game social-engineering takeover of an open-source library planted a backdoor in liblzma, targeting SSH — caught by luck (a performance anomaly) days before wide release.

• Why hard to catch:
• Delivered through a legitimate, signed channel — signature checks pass.
• Behaves normally until triggered; blends into trusted processes.
• Trust is transitive — you inherit every dependency's risk.