Supply Chain Attacks, the FBI DCSNet Breach, and the Case for Validated Data Recovery
For years, the dominant cybersecurity narrative has centered on one scenario: ransomware actors targeting an organization directly, encrypting its data, and demanding payment. That threat remains real and growing. But threat intelligence firm Cyble’s 2025 annual report reveals that the attack surface extends considerably further. One of its fastest-growing vectors is the supply chain attack.
In 2025, supply chain attacks claimed by threat groups surged 93%, climbing from 154 incidents in 2024 to 297. Ransomware attacks rose 52% over the same period, reaching 6,604 incidents — with December 2025 recording 731 attacks, the second-highest monthly total ever. These two trends are not independent.
“As ransomware groups are consistently behind more than half of supply chain attacks, the two attack types have become increasingly linked.” — Cyble, 2025 Threat Landscape Report
The convergence matters operationally. Ransomware groups are no longer simply locking files and demanding payment. They are using trusted vendor relationships to deliver their payloads into environments they could not reach directly. A supply chain attack is increasingly the delivery mechanism for a ransomware event.
A supply chain attack does not target the victim organization directly. Instead, it compromises a third party that the target organization trusts and relies upon — a software vendor, a managed service provider, a cloud integration partner, or a network connectivity provider. Once that third party is compromised, attackers use the access and trust that relationship provides to move into the target environment.
The payload delivered through that trusted channel can be ransomware, a persistent backdoor, a data exfiltration tool, or a combination. The critical point is that because the delivery mechanism is a trusted source, it has often already passed the target’s security checks. Firewalls, endpoint detection tools, and network monitoring are calibrated to flag unknown or suspicious sources, not software updates from a vendor the organization has used for years.
According to Cyble, the sophistication of supply chain attacks in 2025 expanded well beyond traditional package poisoning. Attackers targeted:
Salesforce integrations are a concrete 2025 example cited by Cyble: attackers weaponized OAuth-based trust between SaaS platforms, using compromised third-party tokens to gain access to customer environments. The customer’s own Salesforce instance was not breached. The breach came through a connected application they trusted.
Cyble documented 57 new ransomware groups, 27 new extortion groups, and more than 350 new ransomware strains in 2025. The landscape continued to evolve rapidly in response to law enforcement disruptions:
The U.S. remained the most targeted country at 55% of all attacks. Construction, professional services, manufacturing, healthcare, and IT were the most targeted sectors.
The 2025 surge in supply chain attacks did not emerge from nowhere. The pattern has been building for years. Understanding the progression helps explain why the FBI DCSNet breach, described in Part II, follows a predictable playbook:
SolarWinds Orion (2020) — Malicious code injected into a trusted software update via the vendor’s own build pipeline. Impact: 18,000+ organizations compromised, including multiple U.S. federal agencies. Attackers were resident for months before detection. Attributed by U.S. intelligence to Russia’s SVR.
Kaseya VSA (2021) — Vulnerability in IT management software used by managed service providers. Impact: REvil ransomware pushed to 1,500+ downstream MSP customers in a single cascading attack. Kaseya’s own customers were reached without Kaseya itself being the primary target.
MOVEit Transfer (2023) — Zero-day vulnerability in a widely used managed file transfer tool. Impact: Cl0p ransomware group accessed data from hundreds of organizations simultaneously through a single vendor’s unpatched vulnerability. One of the largest single-event data theft campaigns on record.
XZ Utils backdoor attempt (2024) — Multi-year social engineering of an open-source maintainer to insert a backdoor into a core Linux compression utility. Impact: Detected before widespread exploitation. Demonstrated that state-level actors are willing to invest years in open-source supply chain targeting. Attributed by researchers to a China-linked actor.
Salt Typhoon telecom campaign (2019–2024) — Exploitation of CALEA lawful intercept infrastructure at major U.S. carriers. Impact: Nine U.S. telecoms compromised. Call records of 1M+ users accessed. FBI wiretap data exposed from within carrier systems. Described by U.S. officials as the worst telecom hack in American history.
FBI DCSNet breach (2026) — Vendor ISP exploitation to reach FBI’s internal surveillance network. Impact: Active wiretap targets, FISA data, and law enforcement PII accessed. Formally classified as a FISMA major incident. White House, DHS, and NSA joined the investigation.
The through line across all of these incidents is identical: the attacker did not defeat the target’s own defenses. They compromised someone the target trusted, then used that trust as their entry credential. Each incident informed the next. The FBI breach is not an isolated anomaly. It is the latest iteration of a strategy that has been refined over more than five years.
The Digital Collection System Network (DCSNet) is the FBI’s internal, unclassified infrastructure for managing court-authorized surveillance operations. It provides agents with a centralized, point-and-click interface to conduct and monitor wiretaps across cellular and landline networks, operating over a private fiber-optic backbone separate from the public internet.
The specific module accessed in this breach was DCS-3000, an internal subsystem known as “Red Hook.” Red Hook handles pen register and trap-and-trace surveillance operations: it does not capture the content of communications, but collects the metadata surrounding them. That metadata includes:
The counterintelligence value of this data is difficult to overstate. A foreign intelligence service that knows who the FBI is currently investigating, which phone numbers are being monitored, and which targets are active can identify its own operatives under surveillance, warn them, alter their behavior, and compromise ongoing operations, all without triggering any formal detection.
“Although no interception of actual call content has been confirmed, the breach of metadata alone could allow a foreign intelligence service to identify undercover assets, expose ongoing criminal investigations, and reveal which of their own operatives the FBI has compromised.” — CPO Magazine
The breach was not the result of a direct assault on FBI systems. The bureau’s own perimeter defenses were not defeated. According to the FBI’s formal notification to Congress, obtained by Politico, the hackers entered by “leveraging a commercial Internet Service Provider’s vendor infrastructure,” attributing the method to the group’s “sophisticated techniques.” The specific ISP has not been publicly named.
This is the same structural dynamic visible in every incident in the table above. The failure point was not the FBI’s internal security. It was the trust relationship between the bureau and an external vendor, and the fact that vendor’s security posture was insufficient to withstand a state-sponsored intrusion. As Xcitium Threat Labs summarized: “The breach did not require direct access to the FBI’s primary infrastructure. It used an external telecom vendor as the gateway, proving how supply chain access becomes operational access.”
Security researchers have mapped this to two MITRE ATT&CK tactics: Trusted Relationship abuse (T1199) and Supply Chain Compromise (T1195). In plain terms: if you cannot breach the target directly, breach someone the target trusts, then use that trust as your credential.
No hacking group has been formally attributed by the FBI, CISA, or the White House as of early April 2026. The investigation remains active. However, investigators and independent researchers have focused attention on Salt Typhoon, a Chinese state-sponsored advanced persistent threat group linked to China’s Ministry of State Security.
That focus is not circumstantial. Salt Typhoon has spent years executing this playbook against this category of target. Between 2019 and 2024, the group infiltrated the CALEA lawful intercept infrastructure of nine U.S. telecommunications companies — AT&T, Verizon, T-Mobile, Lumen, Spectrum, and others — in what U.S. officials described as the worst telecom hack in American history. From within those compromised carrier systems, the group accessed FBI wiretap data, call records covering over one million users, and the private communications of senior government officials and campaign staffers.
The structural connection to the DCSNet breach is direct. CALEA mandated that telecoms build lawful intercept capability into their infrastructure in 1994. That mandate was never accompanied by a corresponding requirement to secure that capability against unauthorized third-party access. Salt Typhoon mapped and compromised that architecture at the carrier level across nearly a decade. The DCSNet breach represents the logical next step: tracing that access back to the FBI systems that receive and process the surveillance data the carriers were built to deliver.
“It was inevitable that foreign hackers would burrow deep into the American communications system the moment the FCC decided to let phone companies write their own cybersecurity rules.” — Sen. Ron Wyden
It is tempting to minimize a breach of “unclassified” systems. That framing is misleading. The FISMA “major incident” classification is not a routine designation: former FBI deputy assistant director for cyber Cynthia Kaiser noted that “only a few agencies declare a major cyber incident every year,” and the threshold requires a determination that the breach is likely to cause demonstrable harm to national security, foreign relations, or civil liberties.
The FBI clearly concluded both conditions were met. The specific consequences include:
The supply chain attack scenarios described above share a characteristic that makes traditional recovery approaches inadequate: the attacker was already inside the trusted environment, using legitimate channels, often for an extended period before detection. The DCSNet breach. The SolarWinds compromise. The Salt Typhoon telecom campaign. In each case, by the time the intrusion was identified, the attacker had been present across multiple backup cycles.
This creates a recovery problem that is fundamentally different from restoring after a ransomware detonation event where the moment of impact is known. When dwell time is measured in months or years, the question “which backup is clean?” cannot be answered by looking at the most recent snapshot.
In a long-dwell supply chain attack, the most dangerous assumption an organization can make is that its most recent backup represents a safe restore point. Verification, not assumption, is the foundation of trusted recovery.
A backup taken during the period of compromise may contain any of the following:
Restoring from a compromised backup does not recover from the attack. It re-establishes the conditions that allowed the attack to persist. The organization has spent its recovery window returning to a state that the attacker has already demonstrated it can operate within.
The SolarWinds compromise remained undetected for approximately nine months. The Salt Typhoon telecom campaign ran for an estimated five years before detection. In both cases, organizations that relied on standard backup-and-restore procedures faced a fundamental problem: their backup windows were shorter than the attacker’s dwell time.
If your backup retention is 30 days and the attacker has been present for 90 days, every backup in that window is potentially tainted. This is not a theoretical risk. It is the specific operational challenge these attacks are designed to create. By maintaining a persistent, low-noise presence over an extended period, the attacker effectively erases the organization’s ability to restore to a clean state using conventional tools.
CyberSense addresses this directly by treating the backup as a subject of inspection rather than a trusted artifact. The analysis is applied to the content of the data, asking not just “is this file present?” but “has this file changed in ways consistent with compromise, and if so, when did that first occur?” That distinction is the operational gap that content-level backup analysis is designed to close.
A consequence of supply chain breaches that applies broadly across private sector organizations — particularly in regulated industries, financial services, healthcare, and legal services — is the integrity of records created or modified during the breach window. When a system is known to have been compromised, the evidentiary standing of records produced during that period is legitimately in question.
The FBI’s situation, where evidence derived from a compromised surveillance system now faces potential admissibility challenges, has a direct private-sector analogue: financial records, compliance documentation, audit trails, and transactional data that passed through a compromised environment during an extended intrusion may all carry the same uncertainty.
CyberSense’s forensic reporting capability generates a documented, timestamped record of what data changed, when the change occurred, and how it compares to prior verified states. For organizations with legal, regulatory, or audit obligations, this is often a core prerequisite for demonstrating the scope and limits of a breach to regulators, auditors, or courts.
The FBI is an extreme case in terms of target sensitivity and adversary sophistication. But the structural dynamics of the attack are not unique to government. Any organization with the following characteristics faces a version of the same recovery problem:
The 2025 data confirms that supply chain attacks are not selective: every industry sector tracked by Cyble was hit. When such an attack occurs, organizations need the capability to identify clean data to recover quickly and confidently.
