2024 is the year the consequences stopped being abstract. A missing multi-factor setting on one remote access portal took a third of United States healthcare payments offline for weeks, and pharmacies turned patients away. In the same year, a supply-chain attacker was found to have spent two years building a genuine reputation in an open-source project before shipping anything malicious, and was caught by accident.
Six kill chains on this site carry a 2024 date. Read together they describe an attacker population that had become patient, industrialized and willing to accept long timelines - and a defensive posture that was still, in several notable cases, missing controls that had been standard advice for a decade.
On this page
Overview: the shape of 2024
If 2023 was the year attackers went upstream to compromise the things everyone trusts, 2024 was the year they demonstrated how long they were prepared to wait, and how little was needed once they arrived.
The year's most technically remarkable event was not a breach at all. XZ Utils was caught before it reached stable distributions, and the only reason it was caught is that a Microsoft engineer investigating an unrelated performance regression noticed sshd logins taking about half a second longer than they should. Had it survived a few more months, a backdoor giving pre-authentication root access to one key holder would have been present on a very large share of the internet's Linux servers.
At the other end of the spectrum, Change Healthcare required no sophistication whatsoever: valid credentials, a Citrix portal with no multi-factor authentication, nine days of quiet lateral movement, then ransomware. Roughly 190 million people affected - the largest healthcare breach in United States history - from a control that has been standard advice since before the company existed.
The incidents that defined 2024
| Incident | When | Root cause in one line |
|---|---|---|
| Midnight Blizzard / Microsoft | Jan | Password spray on a legacy test tenant with no MFA, then a legacy OAuth app with production rights |
| Change Healthcare / ALPHV | Feb | Stolen credentials on a Citrix portal with no multi-factor authentication |
| XZ Utils (CVE-2024-3094) | Mar | Two years of legitimate contributions, then a backdoor shipped only in release tarballs |
| Snowflake / UNC5537 | Apr-Jun | Infostealer credentials against accounts with no MFA enforced |
| Polyfill.io | Feb-Jun | The domain was sold; every site still loading the script served its visitors malware |
| Ultralytics | Dec | A fork branch name poisoned the Actions cache; the release carried valid provenance |
Theme 1: The supply chain learned patience
Every prior supply-chain compromise on this site began with theft or exploitation - a stolen token, a phished maintainer, a poisoned build step. XZ Utils began with work. An identity using the name Jia Tan created an account in August 2021 and spent roughly two years making genuine, useful, reviewed contributions. Suspected sock puppet accounts pressured the exhausted unpaid maintainer over release delays until, in January 2023, Jia Tan held maintainer rights to a compression library present on essentially every Linux system.
The technical execution matched the patience. The enabling change - IFUNC support, which provides a hook executing during dynamic linking - was committed months in advance with a legitimate performance justification. The payload never appeared in the git repository at all: it lived in the release tarballs, hidden in files that looked like binary compression test fixtures, and was assembled at build time only on x86-64 Linux with glibc and GCC under dpkg or rpm.
Code review could not have caught this, and saying so plainly matters more than any control recommendation. What the attack actually exploited was one burned-out volunteer maintaining critical infrastructure alone for free - the same condition event-stream exposed in 2018. The transferable controls are narrow but real: build from tagged source rather than tarballs, verify that released artifacts correspond to the commits they claim, and fund the maintainers of what you depend on.
Theme 2: Infostealer logs became an industry
UNC5537 did not exploit Snowflake. It logged in, using credentials harvested by commodity infostealer malware from employee and contractor machines - some of them personal, unmanaged devices - against accounts where multi-factor authentication was supported but not enforced. More than 165 organizations were affected downstream.
The significance is economic rather than technical. Infostealer logs are cheap, sold in bulk, and continuously replenished; what UNC5537 demonstrated is that a patient buyer can convert that supply into a campaign against a specific platform's customer base. That model has since underpinned Megalodon in 2026, where over a third of affected repository owners were on machines with known infections, and it opened the Vercel chain the same year.
The uncomfortable implication for defenders is that your identity perimeter includes machines you do not manage and cannot see. The controls that work are the ones that make a stolen password insufficient rather than the ones that try to prevent theft: enforced phishing-resistant MFA with no exceptions, short-lived credentials, and no standing access to sensitive platforms from unmanaged devices.
Theme 3: The consequences got physical
Most breaches are measured in records or dollars. Change Healthcare is measured in whether a patient could collect a prescription.
The company processes around 15 billion healthcare transactions a year and touches roughly one in three United States patient records. With it offline, pharmacies could not verify coverage, providers could not submit claims or get paid, and small practices went weeks without revenue - some borrowing to make payroll. UnitedHealth reportedly paid approximately $22 million, after which the data resurfaced under a second extortion attempt following an apparent exit scam within the ALPHV operation.
The structural lesson is concentration. Efficiency had routed a third of a country's patient transactions through a single processor, and none of the thousands of downstream providers had chosen that dependency or could see it. This is the same shape as the 2023 MOVEit campaign, where most victims had never heard of the software - their payroll provider ran it - and it is the argument for mapping which third parties would stop your operations if they stopped, then building an alternate path for the ones with no substitute.
Theme 4: The forgotten thing is the way in
Two chains this year began somewhere nobody was looking. Midnight Blizzard password-sprayed a legacy, non-production Microsoft test tenant containing an account with a guessable password and no MFA - an environment outside whatever baseline governed the real estate, still existing because it was not production and therefore not in the inventory that drives security policy. From there a legacy OAuth application that still held elevated corporate permissions turned a test-environment compromise into access to senior leadership, legal and security mailboxes. Microsoft's March update then disclosed that secrets found inside those emails were being used to reach source code repositories.
Polyfill.io is the same idea applied to the client side. Nobody was hacked: the domain was sold, and every website still carrying a script tag added years earlier - long after the polyfills it provided had stopped being necessary - began serving malicious code to its own visitors. The payload fired only for mobile users and suppressed itself for repeat visitors and anything resembling analysis, so developers checking on desktop saw a clean script.
Both are inventory failures rather than control failures. The tenant nobody owned, and the script tag nobody had audited. Neither would have survived a periodic question as simple as "what do we still have that nobody can justify?"
What this meant for 2025
Three threads carried directly into the following year.
The supply chain moved up-stack. XZ targeted a library; Ultralytics targeted the build pipeline that produces libraries, poisoning the Actions cache so a legitimate release run carried the payload. 2025 continued along that axis with tj-actions, Nx s1ngularity and the Shai-Hulud worm, all attacking the pipeline rather than the code.
Provenance became the answer, and then a target. Ultralytics is the prototype for what 2026 made routine: the malicious releases were published by the project's genuine Trusted Publishing workflow and carried correct attestations, because the build environment rather than the publishing path had been compromised.
Identity remained the largest category, unchanged. Change Healthcare, Snowflake and Midnight Blizzard all turn on an account without a second factor. That is three of the year's six chains, and the control that would have broken all three has been standard advice for longer than most of the affected systems have existed.