China's Silk Typhoon APT Shifts to IT Supply Chain Attacks

Silk Typhoon has shifted tactics to target IT supply-chain providers—remote management tools, cloud applications, identity management and PAM platforms—using stolen API keys, compromised credentials and zero-day exploits to infiltrate downstream customers and exfiltrate sensitive government and sector information; this supply-chain approach increases attack surface and complicates detection and incident response.