Google Just Attributed the Axios Hack to North Korea

TL;DR

Google Threat Intelligence Group (GTIG) attributed the Axios npm supply chain attack to UNC1069, a North Korea-nexus financially motivated threat actor. The malware dropped via the compromised plain-crypto-js dependency is WAVESHAPER.V2, with infrastructure overlaps to previous UNC1069 operations. SentinelOne independently corroborated the attribution, finding the macOS binary overlaps with WaveShaper variants used since 2023. The macOS binary contains build paths referencing "macWebT," which links directly to BlueNoroff's RustBucket and Hidden Risk campaigns. Mandiant expects the attackers to pivot from the initial supply chain compromise to cryptocurrency theft using harvested credentials. Huntress confirmed 135 compromised devices at approximately 12 companies. Google published YARA rules for WAVESHAPER.V2, SILKBELL (the JavaScript dropper), and associated hunting queries for Google SecOps and Wiz customers. The malicious Axios versions were live on npm for approximately 3 hours before removal.

DPRK

Attribution

135

Devices Confirmed

Companies Hit

2018+

UNC1069 Active Since

What Changed Since Yesterday

When we published our initial analysis yesterday, the Axios compromise was attributed to "unknown" with indicators suggesting APT-level sophistication rather than cybercrime. In the 24 hours since, the picture has come into sharp focus.

Google formally attributed the attack to UNC1069. John Hultquist, GTIG's chief analyst, stated: "We have attributed the attack to a suspected North Korean threat actor we track as UNC1069. North Korean hackers have deep experience with supply chain attacks, which they've historically used to steal cryptocurrency." UNC1069 has been active since at least 2018, targeting cryptocurrency and decentralized finance (DeFi) companies, software developers, and related targets.

The malware is WAVESHAPER.V2. Google identified the cross-platform backdoor as an updated version of WAVESHAPER, previously used by UNC1069. The JavaScript dropper is tracked as SILKBELL. The macOS binary contains developer build paths referencing Jain_DEV/client_mac/macWebT/macWebT, where "macWebT" links directly to BlueNoroff's "webT" module from the RustBucket and Hidden Risk malware campaigns documented in 2023. This is a clear forensic linkage between the Axios compromise and North Korea's broader cyber operations.

SentinelOne independently corroborated the attribution. Elastic Security Labs also confirmed the macOS binary overlaps with previously documented WaveShaper variants. Multiple independent research teams reaching the same conclusion from different angles strengthens confidence in the DPRK attribution.

Mandiant expects cryptocurrency theft as the next objective. Charles Carmakal, Mandiant's CTO, told CNN: "We anticipate they will try to leverage the credentials and system access they recently obtained in this software supply chain attack to target and steal cryptocurrency from enterprises." This aligns with North Korea's documented pattern: supply chain compromise as an access mechanism, followed by lateral movement to cryptocurrency wallets and exchange platforms, with stolen funds funneled to DPRK's nuclear and missile programs.

Huntress has confirmed 135 compromised devices at approximately 12 companies. This is the first concrete victim count. Given the 3-hour exposure window and the fact that only organizations running npm install during that window would have pulled the compromised version, 12 confirmed companies represents the early detection. The actual count will grow as more organizations audit their environments.

Why DPRK Attribution Matters

North Korea's attribution changes the risk calculus for every organization that may have been exposed. This is not a criminal group seeking ransom or a hacktivist group seeking attention. This is a nation-state actor with a specific operational objective: stealing cryptocurrency to fund weapons programs.

The 3CX precedent is instructive. In 2023, North Korean hackers compromised the enterprise phone software company 3CX in a supply chain attack that was later traced back to an earlier supply chain compromise of a cryptocurrency trading application. The attack chain was recursive: compromise one supply chain to gain access to another supply chain, then use that access to steal cryptocurrency. The Axios compromise follows the same logic. The initial supply chain attack harvests credentials from developer machines and CI/CD environments. Those credentials provide access to internal systems, cloud environments, and, crucially, cryptocurrency-related infrastructure.

The timeline from access to theft can be weeks, not days. North Korean cyber operations are characterized by patience. They gain access, establish persistence, conduct internal reconnaissance, and wait for the right moment to execute the financial theft. Organizations that were exposed during the 3-hour window should not assume the threat has passed just because the malicious npm packages were removed. If WAVESHAPER.V2 executed successfully on any system, the attacker has persistent access independent of the npm compromise.

Stolen cryptocurrency funds DPRK weapons programs. The UN Panel of Experts has documented that North Korean cryptocurrency theft, totaling billions of dollars over the past several years, directly funds the country's nuclear weapons and ballistic missile programs. This gives the Axios compromise a geopolitical dimension that extends beyond cybersecurity. Organizations that fail to remediate may be indirectly contributing to weapons proliferation through inaction.

Updated Attack Chain

Figure 01

PREPARATION

UNC1069 Stages Infrastructure

Clean plain-crypto-js@4.2.0 published 18 hours before attack. npm account "jasonsaayman" compromised via stolen long-lived access token. Account email changed to ifstap@proton.me to lock out legitimate maintainer. C2 infrastructure at sfrclak.com:8000 stood up.
T+0 // MAR 31 00:21 UTC

Poisoned Axios Published

axios@1.14.1 and axios@0.30.4 published with plain-crypto-js@4.2.1 dependency. SILKBELL dropper (setup.js) executes on npm install. OS-specific WAVESHAPER.V2 backdoor deployed. Self-deletion in 36 seconds.
T+0 TO T+3H // CRITICAL

WAVESHAPER.V2 Active

macOS: /Library/Caches/com.apple.act.mond (spoofed Apple daemon, linked to BlueNoroff "macWebT" module). Windows: PowerShell-based backdoor with PE injection capability. Linux: Python RAT. All beacon to C2 every 60 seconds. Credential harvesting begins immediately.
T+3H

Packages Removed from npm

Malicious versions pulled. But WAVESHAPER.V2 persists independently on any device that installed the compromised versions. Backdoor access is maintained. C2 communication continues. The npm removal does not remediate compromised systems.
NOW // CRITICAL

Credential Harvesting & Lateral Movement

UNC1069 processes stolen credentials: npm tokens, AWS keys, SSH keys, cloud credentials, .env files, CI/CD secrets. Mandiant expects pivot to cryptocurrency wallets and exchange platforms. Huntress confirms 135 devices at 12 companies. Actual exposure likely much higher.
EXPECTED

Cryptocurrency Theft Operations

Consistent with UNC1069/BlueNoroff pattern: harvested credentials used to access cryptocurrency wallets, DeFi platforms, and exchange accounts. Stolen funds laundered through mixing services and converted to support DPRK weapons programs. Timeline: weeks to months from initial access.

Updated IOC & Detection Details

Attribution: UNC1069 (North Korea-nexus, active since 2018)
Malware Family: WAVESHAPER.V2 (backdoor), SILKBELL (JavaScript dropper)
Historical Linkage: BlueNoroff RustBucket, Hidden Risk campaigns (2023)
macOS Build Path: Jain_DEV/client_mac/macWebT/macWebT
macOS RAT: /Library/Caches/com.apple.act.mond
Windows RAT: %PROGRAMDATA%\wt.exe (PowerShell, supports PE injection + script execution)
Linux RAT: /tmp/ld.py
C2: sfrclak.com:8000 (142.11.206.73)
Beacon Interval: 60 seconds
C2 Commands: rsp_peinject, rsp_runscript, rsp_rundir, Init-Dir-Info, Do-Action-Ijt, Do-Action-Scpt
Dropper Hash (SILKBELL): e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
YARA Rules: Published by GTIG (G_Backdoor_WAVESHAPER.V2_JS_1, G_Backdoor_WAVESHAPER.V2_PS_1)
Confirmed Victims: 135 devices across ~12 companies (Huntress)
Wiz Observation: Executed in 3% of affected environments
Detection Platforms: Google SecOps (Mandiant Intel Emerging Threats rule pack), Wiz Threat Center

Defensive Takeaways

1
If WAVESHAPER.V2 Executed, Treat the System as Fully Compromised
Check for RAT artifacts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), /tmp/ld.py (Linux). If found, do not attempt to clean in place. Rebuild from a known-good state. Rotate every credential that was accessible from the compromised system. This includes npm tokens, cloud provider credentials (AWS, Azure, GCP), SSH keys, CI/CD secrets, database passwords, and any values in .env files. WAVESHAPER.V2 supports PE injection and arbitrary script execution, which means the attacker may have deployed additional persistence beyond the initial RAT.
2
Deploy Google's Published YARA Rules and Detection Queries
Google published YARA rules for WAVESHAPER.V2 (both JavaScript and PowerShell variants) and SILKBELL. Deploy these in your endpoint detection platform. Google SecOps customers have access to updated Mandiant Intel Emerging Threats rules. Wiz customers should check the Wiz Threat Center for pre-built queries. If you use neither platform, the YARA rules are publicly available in Google's blog post and can be deployed in any tool that supports YARA scanning (YARA-X, ClamAV, osquery, Velociraptor, etc.).
3
Prioritize Cryptocurrency and Financial System Access in Your Response
Mandiant expects UNC1069 to pivot from the initial supply chain compromise to cryptocurrency theft. If your organization holds cryptocurrency, operates DeFi infrastructure, manages exchange accounts, or has employees with access to crypto wallets from compromised devices, treat this as a priority escalation. Review access logs for cryptocurrency-related systems. Force re-authentication for any account that was accessible from a device that may have installed the compromised Axios versions. Consider temporarily restricting cryptocurrency transaction capabilities until the audit is complete.
4
Monitor for Lateral Movement From Developer Machines
The primary targets of the Axios compromise were developer workstations and CI/CD runners. These systems typically have access to source code repositories, cloud infrastructure, production environments, and internal services. Monitor for unusual authentication activity originating from developer machines: logins to systems that developers do not normally access, SSH connections to production servers from development endpoints, cloud API calls from unexpected source IPs, and new service account creation. UNC1069's operational pattern involves weeks of internal reconnaissance before executing the financial theft objective.
5
Report to FBI and CISA If You Confirm Compromise
This is a confirmed nation-state attack attributed to North Korea by Google Threat Intelligence, Mandiant, SentinelOne, and Elastic. If your organization confirms that WAVESHAPER.V2 executed in your environment, report it to the FBI's Internet Crime Complaint Center (IC3) and CISA. This is not just good practice. If stolen credentials from your environment are used to steal cryptocurrency that funds DPRK weapons programs, the regulatory and reputational implications of having known about the compromise and not reporting it are significant. Law enforcement and intelligence agencies are actively tracking UNC1069's post-compromise activity and your reporting may help protect other organizations in the chain.

Atarus Assessment

Yesterday, the Axios compromise was a sophisticated supply chain attack of unknown attribution. Today, it is a confirmed North Korean state operation targeting the most widely used HTTP client in the JavaScript ecosystem, with named malware (WAVESHAPER.V2), forensic linkage to previous DPRK campaigns (BlueNoroff, RustBucket, Hidden Risk), confirmed victims (135 devices, 12 companies), and an expected next objective (cryptocurrency theft to fund weapons programs). The attribution to UNC1069 transforms this from an incident response problem into a national security problem. March 2026 ends with the open source supply chain under sustained attack from multiple state actors: TeamPCP cascaded through security tooling, an unknown APT staged the Telnyx compromise with steganographic WAV files, and now North Korea has demonstrated that even the most foundational JavaScript dependency can be weaponized in hours. The implicit trust model that powers the open source ecosystem is the vulnerability that all of these attacks exploit. A single maintainer account, a single stolen token, and 100 million weekly downloads become a weapon delivery system. That model must change. The question is whether it changes because the ecosystem chooses to fix it, or because the next attack is even worse than this one.