How does an attacker prefer to carry out supply-chain attacks?

Targeting an organization directly through phishing or exploiting vulnerabilities is a direct attack, not specifically a supply-chain attack which leverages a trusted third party.

A common method for supply-chain attacks involves compromising individuals within a software vendor or supplier organization, such as software developers, to gain access to their development environment and inject malicious code into legitimate software. This allows the malware to be distributed covertly through trusted channels.

Targeting items not written to disk (fileless malware) is a technique, but it's not the method of carrying out a supply-chain attack; it's a characteristic of some payloads.

While upper management can be targets, compromising software developers or those with access to product development is more aligned with the goal of injecting malicious code into the supply chain itself.