Code Dependency: Chinese APTs in Software Supply Chain Attacks

The talk, given by a threat intelligence analyst rather than a developer, frames software supply chain attacks as an abuse of trust. An adversary compromises one trusted source, such as a vendor's update channel or build system, and the malicious code then reaches many downstream customers. The speaker argues that modern applications rely heavily on third-party and open-source dependencies, producing deep dependency trees that teams rarely audit or update. Misconfigurations such as exposed SonarQube instances and hard-coded credentials in source code make the problem worse.

The middle section walks through a timeline of incidents. These include the 2009 Operation Aurora intrusion into source code systems, the 2017 NotPetya wave spread through a hijacked accounting software update, the 2019 ShadowHammer abuse of ASUS Live Update, and the SolarWinds Orion compromise, which altered the build environment and used stolen code-signing certificates. Later cases cover dependency confusion, the Codecov uploader tampering, and the Kaseya VSA agent hotfix. The speaker then covers Chinese state-linked groups, including APT17 and its CCleaner and ShadowPad operations, and the GoldenSpy malware hidden in tax payment software.

The takeaways focus on visibility. Organizations need far better insight into the open-source components they use, because static scans from legacy tools miss changes and real exposure. The speaker points to Sigstore for signing software artifacts and GitLab's Package Hunter for flagging malicious code and unexpected behavior in dependencies. Defenders should also scrutinize service accounts that hold broad privileges and rarely get reviewed.