Supply chain attacks now fuel a 'self-reinforcing' cybercrime economy