NSFOCUS: China-Based Cybersecurity Firm Enabling Threat Actor Intrusions
U.S. and international agencies warn that NSFOCUS, a China‑based cybersecurity vendor, is supplying tools that Chinese state‑sponsored actors (APT41, Salt Typhoon) repurpose for reconnaissance, credential harvesting, lateral movement, and data exfiltration against critical infrastructure. Legitimate products—SMP console, vulnerability scanners, IDS, and remote‑access agents—are abused to deploy Daxin, PlugX/Sakula variants, custom loaders, and web shells. Over 30 countries and >200 intrusions have been recorded since 2021, affecting energy, telecom, finance, healthcare, and government sectors, with estimated losses >$2.1 billion and >150 TB of IP stolen.
Supply Chain Attacks Industrialized: SaaS, Open Source, and MSP Ecosystems as Primary Attack Vectors in 2026
In 2026, threat actors have industrialized supply‑chain compromise, treating SaaS platforms, open‑source repositories, and managed service provider (MSP) ecosystems as repeatable production lines. Initial access is gained via credential stuffing or phishing, followed by insertion of malicious code into npm packages, hijacked GitHub Actions workflows, trojanized SaaS plugins, and backdoored MSP RMM agents. These compromised vectors enable lateral movement through trusted update mechanisms and monetization via ransomware, data exfiltration, or cryptojacking, with attack frameworks sold as a service lowering the barrier for large‑scale campaigns.