An Analysis of Software Supply Chain Attacks

For attacks like this to work, the target system must be accessible. It must face the Internet to allow the stolen credentials to be used, or the additional backdoor to be accessed. Until recently, business systems tended to be isolated, accessed from inside a corporate office with limited access to external resources, so attacks like these also needed the right physical access, which meant they can only be highly targeted. But the move to cloud services and home working means this is no longer the case.