An Analysis of Software Supply Chain Attacks

If the attack has a very specific target, say a particular bank, then the attack needs to have a way of establishing that it is running in the target before causing the damage. In other systems it must lie low and avoid detection. This makes the attack “one shot.” Once it has reached the target it will be discovered, and the flaw will then get removed. This means the attack must be worth the not inconsiderable effort that went into creating it.