Supply chain attacks: threats targeting service providers and design offices

ANSSI (v1.0, Oct 2019) warns of supply-chain attacks targeting service providers and design offices: an initial wave using PlugX and a more recent wave relying on stolen credentials and legitimate administration tools to access client networks. The report documents attacker TTPs (VPN/TOR anonymization, RDP lateral movement, ProcDump/CertMig/Mimikatz usage, browser-monitoring custom malware), IOCs (VPN exit-node IP ranges, VMware MAC prefixes, registry PortProxy keys, unusual folders), detection rules and pragmatic recommendations for service providers and clients to monitor, segment and harden connections.