Third-Party and Supply Chain Ransomware
Attack Vectors, Kill Chains, and Resilience for Outsourced Operations
CyberCQR White Paper | September 2026
1. Executive Summary
Ransomware increasingly reaches organisations through the third parties they depend on — outsourced IT providers, facilities contractors, and software vendors — rather than through their own perimeter. This is now a measurable, accelerating pattern rather than an emerging concern:
Third-party involvement in confirmed data breaches doubled from 15% to 30% in a single year. (Verizon 2025 DBIR [15])
Vulnerability exploitation as an initial access vector rose 34% year-on-year, including an eight-fold increase in attacks on VPNs. (Verizon 2025 DBIR [15])
Ransomware rose 37% year-on-year and is now present in 44% of confirmed breaches. (Verizon 2025 DBIR [15])
Supply-chain compromise — attacks on software vendors, cloud integrators, MSP/MSSP partners, and CI/CD pipelines — is identified among the leading threat categories facing NIS2-regulated sectors, including energy, transport, finance, public administration, and manufacturing. (ENISA Threat Landscape 2025 [5])
This paper sets out the attack vectors through which third-party compromise reaches an organisation (Section 3), the kill chains by which that access is converted into ransomware impact (Section 4), the risk profile of the outsourced relationships most commonly involved (Section 5), the controls that interrupt each stage (Section 6), the resilience measures that limit impact when prevention fails (Section 7), and the regulatory drivers now making this a board-level accountability matter rather than a purely operational one (Section 8).
2. Threat Landscape Context
The conditions behind Section 1’s statistics are structural, not incidental:
Ransomware-as-a-service operators have responded to law enforcement action by decentralising operations and adopting more aggressive extortion tactics, while builder leaks and access-broker markets continue to lower the barrier to entry. (ENISA Threat Landscape 2025 [5])
State-aligned groups have intensified long-term cyberespionage campaigns against telecommunications, logistics, and manufacturing, demonstrating advanced tradecraft including supply chain compromise and abuse of signed drivers. (ENISA Threat Landscape 2025 [5])
Abuse of “cyber dependencies” has intensified: compromises in open-source repositories, malicious browser extensions, and breaches of service providers now amplify risk throughout interconnected digital ecosystems. (ENISA Threat Landscape 2025 [5])
Exploited vulnerabilities remain the leading technical root cause among enterprises that experienced a ransomware incident, ahead of phishing and compromised credentials. (Sophos, State of Ransomware in Enterprise 2025 [14])
Supporting data (third-party research): Black Kite’s 2026 Supply Chain Vulnerability Report frames this as a shift toward concentration rather than distribution — ransomware operators increasingly compromise the shared software and infrastructure many organisations rely on simultaneously, rather than attacking organisations individually. Single 2025 campaigns by groups including Qilin, Clop, and Akira each reached victims across 50–90 countries. (Black Kite, 2026 Supply Chain Vulnerability Report [1])
3. Attack Vectors
Ordered alphabetically. Each vector is scoped to the third-party/outsourced-IT and facilities context and feeds directly into the Section 4 kill chain and Section 6 mitigations.
| Attack Vector | Mechanism | ATT&CK Mapping | Reference |
|---|---|---|---|
| Compromised MSP/RMM Tooling | Attacker compromises a managed service provider’s remote monitoring & management platform or credentials, gaining the same privileged, multi-tenant access the MSP itself holds across client environments. | T1199, T1219 | Joint MSP Advisory (AA22-131A) [4] |
| Exploited Third-Party Software Vulnerabilities (CVEs) | Unpatched or zero-day vulnerabilities in externally-facing vendor software provide direct initial access, bypassing the target’s own perimeter controls entirely. | T1190 | Verizon 2025 DBIR [15] |
| Facilities/OT-Adjacent System Compromise | Building management systems, access control, HVAC, and CCTV — typically outsourced, network-connected, and poorly segmented from core IT — provide a lateral route into the corporate environment. | T1210 | ENISA Threat Landscape 2025 [5] |
| Help Desk/Vishing & Executive Impersonation | Social engineering targeted at vendor or internal help desk staff to reset credentials or bypass identity verification, exploiting the trust relationship between organisation and outsourced support function. | T1566.004, T1078 | ENISA Threat Landscape 2025 [5] |
| Software Supply Chain Compromise (Dependency/Package Poisoning) | Malicious code introduced via compromised open-source packages, build pipelines, or software updates that vendors incorporate and distribute downstream. | T1195.001/.002 | ENISA Threat Landscape for Supply Chain Attacks [6] |
| Stolen or Leaked Vendor Credentials | Credentials harvested via infostealer malware, breach databases, or credential stuffing are used to authenticate as a legitimate vendor identity, often without triggering anomaly detection. | T1078, T1552 | ENISA Threat Landscape 2025 [5] |
4. Kill Chain Analysis
4.1 Framework Basis
This section maps the Section 3 attack vectors to a structured kill chain, showing how a compromise originating in a third-party relationship progresses to ransomware deployment and extortion. Three frameworks are combined:
The Lockheed Martin Cyber Kill Chain provides the high-level stage structure used as the backbone below.
MITRE ATT&CK supplies granular, named techniques for each stage, traceable to a specific technique ID. (MITRE ATT&CK [11])
MITRE ATLAS is applied where attacker tooling is itself AI-enabled and a standard ATT&CK technique does not adequately capture the tactic. (MITRE ATLAS [10])
Two sub-chains are presented alongside the baseline chain, reflecting the two outsourced-relationship types this paper is scoped to. Both converge with the baseline chain from lateral movement onward.
4.2 Baseline Third-Party Kill Chain
| Stage | Description | ATT&CK | Section 3 Vector(s) |
|---|---|---|---|
| 1. Reconnaissance | Attacker profiles target organisations indirectly, via their third-party suppliers rather than the eventual victim. | T1591, T1593 | — |
| 2. Initial Access (via Third Party) | Foothold gained inside the vendor via credential theft, exploited vulnerabilities, or social engineering. | T1199, T1190, T1078 | Compromised MSP/RMM; Exploited CVEs; Vishing; Stolen Credentials |
| 3. Execution & Persistence | Durable access established via scheduled tasks, autostart entries, or abuse of vendor remote-access tooling. | T1053, T1219 | Compromised MSP/RMM |
| 4. Privilege Escalation | Escalation from a standard vendor account to one holding privileged, cross-client access. | T1078, T1068 | Compromised MSP/RMM; Stolen Credentials |
| 5. Lateral Movement | Privileged vendor access is used to pivot into one or more target environments. | T1021, T1570 | Software Supply Chain; Facilities/OT |
| 6. Collection & Exfiltration | Data of value is staged and exfiltrated ahead of encryption — the precursor to double extortion. | T1560, T1567 | — |
| 7. Impact (Encryption & Extortion) | Ransomware deployed; extortion demand issued, frequently with a threat to publish exfiltrated data. | T1486 | — |
4.3 Sub-Chain A: MSP-as-Pivot
Describes a single MSP compromise cascading into simultaneous impact across multiple, otherwise unrelated clients — the defining pattern distinguishing third-party ransomware from a conventional single-target intrusion. Replaces Stages 1–2 of the baseline chain; Stages 5–7 then apply independently to each affected client.
| Stage | Description | ATT&CK |
|---|---|---|
| A1. Vendor Compromise | The MSP itself is compromised: a phished employee, an exploited MSP-facing application, or leaked administrative credentials. | T1199, T1078, T1566 |
| A2. Access to Multi-Tenant Tooling | Attacker gains control of the MSP’s RMM platform — the single interface managing many clients. | T1219 |
| A3. Simultaneous Multi-Client Staging | Using the RMM’s legitimate deployment mechanism, access/tooling/payload is staged across every managed tenant in parallel. | T1072 |
| A4. Coordinated Encryption Across Downstream Victims | Encryption triggered across staged clients within a narrow window, producing simultaneous impact across unrelated organisations. | T1486 |
This is the pattern documented by CISA, NCSC-UK, ACSC, CCCS, NCSC-NZ, NSA and FBI in their joint advisory to MSPs and their customers, which references the 2020 SolarWinds compromise as an illustrative case (developed further in Section 9). (Joint MSP Advisory (AA22-131A) [4])
4.4 Sub-Chain B: Facilities/OT-Adjacent Pivot
Describes initial access via an outsourced facilities relationship — BMS, access control, HVAC, or CCTV — rather than IT services directly. Replaces Stages 1–4 of the baseline chain; Stages 5–7 then apply.
| Stage | Description | ATT&CK |
|---|---|---|
| B1. Facilities System Compromise | Access gained via an unpatched vulnerability in the BMS/access-control platform or default/shared vendor credentials. | T1190, T1078 |
| B2. Establishment on the OT-Adjacent Segment | Foothold established on the network segment hosting the facilities system, often over-provisioned for remote vendor support. | T1210 |
| B3. Lateral Movement Into Corporate IT | Inadequate segmentation allows movement from the OT-adjacent segment into standard IT infrastructure. | T1021, T1570 |
| B4. Convergence With Baseline Chain | Proceeds as Stages 5–7 of the baseline chain: collection, exfiltration, encryption, extortion. | T1560, T1567, T1486 |
Consistent with ENISA’s 2025 finding on the growing share of operational technology within identified EU threat categories, reflecting the increasing connectivity of previously isolated networks. (ENISA Threat Landscape 2025 [5])
5. Sector and Relationship Risk Profiles
Ordered alphabetically. The profile of the outsourced relationship determines which Section 4 kill chain applies and which Section 6 controls are most relevant.
| Relationship Type | Typical Access/Exposure | Primary Risk Driver | Reference |
|---|---|---|---|
| Cloud/SaaS Platform Dependencies | Centralised authentication and data hosting across the organisation. | Concentration of many tenants behind one shared control plane. | ENISA Threat Landscape 2025 [5] |
| Data-Processing Outsourcers (payroll, HR, benefits) | Bulk personal or financial data access; typically limited network reach into the client environment. | Data exposure risk without necessarily providing a network pivot point. | NCSC Supply Chain Security Guidance [12] |
| Facilities Management | Network-connected BMS, access control, HVAC, CCTV — often provisioned with broader connectivity than intended for remote vendor support. | Under-segmentation from core IT; rarely treated as an IT security concern historically. | ENISA Threat Landscape 2025 [5] |
| Outsourced IT / Managed Service Providers | Privileged, multi-tenant remote administrative access across the client base. | A single compromise cascades across every client the MSP manages (Sub-Chain A). | Joint MSP Advisory (AA22-131A) [4] |
Mid-sized providers are disproportionately represented in this risk profile: the median ransomware victim generates $42.9 million in annual revenue, and from 2023 through mid-2026, 73% of ransomware attacks in North America and Europe hit mid-market companies — the size band most outsourced IT and facilities providers occupy. (Black Kite, 2026 Manufacturing & Distribution Ransomware Report [2])
6. Mitigations
6.1 Per-Vector Controls
Ordered alphabetically to match Section 3.
| Attack Vector | Primary Control(s) | Reference |
|---|---|---|
| Compromised MSP/RMM Tooling | MFA, least privilege, and time-limited administrative credentials on all vendor remote access; treat RMM platforms as untrusted by default and segment accordingly. | CIS Controls v8 [3] |
| Exploited Third-Party CVEs | Patch SLAs tied to Known Exploited Vulnerabilities prioritisation; vendor vulnerability-disclosure requirements written into contracts. | NIST SP 800-161 Rev. 1 [13] |
| Facilities/OT-Adjacent Compromise | Network segmentation of BMS/access-control systems from core IT; facilities remote access managed as any other privileged account. | CIS Controls v8 [3] |
| Help Desk/Vishing & Executive Impersonation | Identity-verification hardening at the help desk; callback verification for any privilege or credential-reset request. | Joint MSP Advisory (AA22-131A) [4] |
| Software Supply Chain Compromise | Dependency and package integrity verification; maintained software bill of materials (SBOM) for vendor-supplied code. | ENISA Threat Landscape for Supply Chain Attacks [6] |
| Stolen or Leaked Vendor Credentials | MFA enforcement; credential-breach monitoring; conditional access policies keyed to device and location posture. | ISO/IEC 27036-1:2021 [9] |
6.2 Vendor Risk Management Lifecycle
Contractual controls: incident-notification SLAs, right-to-audit, and minimum security-control baselines written into every vendor agreement. (NCSC Supply Chain Security Guidance [12])
Lifecycle approach: NIST’s C-SCRM model applies supply chain risk management across the organisation, mission/business process, and system levels rather than as a one-off assessment. (NIST SP 800-161 Rev. 1 [13])
Supplier relationship security controls, covering both acquirer and supplier perspectives across the relationship lifecycle. (ISO/IEC 27036-1:2021 [9])
Continuous monitoring in preference to point-in-time questionnaires (see Section 2 callout on concentration risk). (Black Kite, 2026 Supply Chain Vulnerability Report [1])
Stage 4 (Privilege Escalation) of the Section 4 baseline chain, and the identity-related entries in Stages A1/A2, connect directly to the Zero Trust and conditional access controls set out in the companion CyberCQR paper Identity as a Security Control.
7. Resilience and Incident Response
Third-party-aware IR plans name key vendors explicitly and define the trigger and isolation playbook for the scenario "a vendor declares an incident."
Reporting timelines aligned to NIS2’s notification cadence (Section 7.1 below). (NIS2 Directive (EU) 2022/2555 [7])
Tabletop exercise scope includes at least one vendor-compromise scenario per annual cycle.
RTO/RPO defined specifically for operations dependent on the organisation’s top three-to-five critical third parties, not just for internal systems.
Business continuity plans for facilities providers assume BMS/access-control unavailability, not solely IT system unavailability.
7.1 NIS2 Reporting Cadence
| Stage | Deadline | Requirement |
|---|---|---|
| Early warning | 24 hours | Initial notification to the competent authority/CSIRT. |
| Incident notification | 72 hours | Initial assessment: severity, impact, and indicators of compromise, where available. |
| Final report | 1 month | Detailed description, root cause, and mitigation measures taken. |
(NIS2 Directive (EU) 2022/2555 [7])
8. Regulatory and Governance Drivers
| Regulation | Scope | Third-Party/Supply Chain Provision | Reference |
|---|---|---|---|
| DORA (Regulation (EU) 2022/2554) | EU financial sector — financial entities and their critical ICT providers. | Articles 28–30: ICT third-party risk management via contractual arrangements; Article 31: EU-level oversight of providers designated critical. | DORA, Regulation (EU) 2022/2554 [8] |
| NIS2 (Directive (EU) 2022/2555) | 18 sectors across essential and important entities. | Article 21(2)(d): supply chain security named as an explicit, mandatory risk-management measure. | NIS2 Directive (EU) 2022/2555 [7] |
NCSC’s 12 supply chain security principles serve as the practical assessment lens underneath both regimes. (NCSC Supply Chain Security Guidance [12])
Board-level reporting expectations for this domain mirror those set out for AI governance in the companion CyberCQR paper Securing AI Services: Overcoming the GenAI Divide — both treat the absence of structured governance, rather than any limit of the underlying technology, as the root cause of failure.
9. Case Reference: SolarWinds
The 2020 compromise of SolarWinds’ Orion platform is the case most consistently cited by NCSC, CISA and partner agencies when illustrating the MSP-as-pivot pattern. (Joint MSP Advisory (AA22-131A) [4]) A caveat is important for accuracy: the SolarWinds campaign’s objective was sustained intelligence access, not ransomware deployment, so it illustrates Stages A1–A3 of Section 4.3’s Sub-Chain A precisely but does not extend to Stage A4 (encryption and extortion). It is included here because the underlying mechanics — vendor compromise, abuse of trusted software-distribution tooling, and simultaneous reach into a large downstream customer base — are identical to those a ransomware-motivated actor would exploit via the same sub-chain.
| Sub-Chain A Stage | SolarWinds Case Facts |
|---|---|
| A1. Vendor Compromise | SolarWinds’ own software build environment was compromised, allowing malicious code to be inserted upstream of the release process. |
| A2. Access to Multi-Tenant Tooling | The malicious code was distributed as a trojanised update to SolarWinds’ Orion network-management platform — software many customers had already granted broad network access. |
| A3. Simultaneous Multi-Client Staging | Approximately 18,000 organisations received the trojanised update; a deliberately selected subset of high-value targets was then further exploited. |
| A4. Coordinated Encryption Across Downstream Victims | Not applicable to this case — the objective was sustained espionage access rather than ransomware deployment. Applicable in a ransomware-motivated variant of this same sub-chain. |
10. Glossary
| Term | Definition |
|---|---|
| ATT&CK | MITRE’s knowledge base of adversary tactics and techniques, used throughout Sections 3–4 to map kill chain stages to named techniques. |
| ATLAS | MITRE’s Adversarial Threat Landscape for Artificial-Intelligence Systems, applied where attacker tooling is itself AI-enabled. |
| BMS | Building Management System — the networked platform controlling HVAC, lighting, and related building infrastructure. |
| C-SCRM | Cybersecurity Supply Chain Risk Management, the NIST SP 800-161 Rev. 1 model. |
| CI/CD | Continuous Integration/Continuous Deployment — automated software build and release pipelines. |
| DORA | Digital Operational Resilience Act, Regulation (EU) 2022/2554. |
| ENISA | European Union Agency for Cybersecurity. |
| KEV | Known Exploited Vulnerabilities — CISA’s catalogue of vulnerabilities confirmed as actively exploited. |
| MSP | Managed Service Provider — a third party delivering, operating, or managing ICT services under contract. |
| NIS2 | Network and Information Security Directive 2, Directive (EU) 2022/2555. |
| RaaS | Ransomware-as-a-Service — a criminal business model in which ransomware tooling is leased to affiliates. |
| RMM | Remote Monitoring and Management software — the centralised tooling an MSP uses to administer client environments. |
| SBOM | Software Bill of Materials — an inventory of the components comprising a piece of software. |
11. Further Reading
Identity as a Security Control (CyberCQR) — Zero Trust and conditional access detail underpinning the Section 6.2 access-control mitigations.
Securing AI Services: Overcoming the GenAI Divide (CyberCQR) — governance framing referenced in Section 8.
This paper is part of the ongoing CyberCQR white paper series on cybersecurity governance, identity, and resilience.
12. References
1. Black Kite — 2026 Supply Chain Vulnerability Report
2026
https://blackkite.com/reports/2026-supply-chain-vulnerability-report
2. Black Kite — 2026 Manufacturing & Distribution Ransomware Report: Still the #1 Target
17 September 2026
3. Center for Internet Security — CIS Critical Security Controls v8
2021
https://www.cisecurity.org/insights/white-papers/cis-controls-v8
4. CISA, NCSC-UK, ACSC, CCCS, NCSC-NZ, NSA and FBI — Joint Cybersecurity Advisory AA22-131A: Protecting Against Cyber Threats to Managed Service Providers and their Customers
11 May 2022
https://www.cisa.gov/uscert/ncas/alerts/aa22-131a
5. ENISA — ENISA Threat Landscape 2025
October 2025
https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025
6. ENISA — Threat Landscape for Supply Chain Attacks
2025
https://www.enisa.europa.eu/publications/threat-landscape-for-supply-chain-attacks
7. European Union — Directive (EU) 2022/2555 (NIS2 Directive)
14 December 2022
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555
8. European Union — Regulation (EU) 2022/2554 (Digital Operational Resilience Act / DORA)
14 December 2022
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554&from=FR
9. International Organization for Standardization — ISO/IEC 27036-1:2021, Cybersecurity — Supplier relationships — Part 1: Overview and concepts
September 2021
https://www.iso.org/standard/82905.html
10. MITRE Corporation — MITRE ATLAS — Adversarial Threat Landscape for Artificial-Intelligence Systems
2023
11. MITRE Corporation — MITRE ATT&CK
2024
12. National Cyber Security Centre (UK) — Supply Chain Security Guidance
2022
https://www.ncsc.gov.uk/guidance/supply-chain-security
13. National Institute of Standards and Technology — SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organisations
May 2022
https://csrc.nist.gov/pubs/sp/800/161/r1/final
14. Sophos — The State of Ransomware in Enterprise 2025
December 2025
https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-enterprise-2025
15. Verizon Business — 2025 Data Breach Investigations Report
April 2025
https://www.verizon.com/business/en-gb/resources/reports/dbir/