Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label UNC1069. Show all posts
UNC1069
Axios Backdoor Cyber Crime Data North Korea UNC1069

North Korean Hackers Target Axios, Steal Cryptocurrency in a Massive Attack


Threat actors from North Korea hacked software used by organizations in the US to steal cryptocurrency to fund North Korea's nuclear and missile programs. Experts found 135 devices across 12 organizations hacked; however, the list of victims can increase. The investigation may take months to uncover full details of the campaign. 

Axios attacked

Hackers targeted Axios, a famous open-source JavaScript library that developers use to oversee HTTP requests. The North Korean gang accessed organizations' systems via malware that opens backdoor access to OS. Hackers targeted two versions of Axios that were downloaded over 183 million times each week; organizations that downloaded it during the particular time period were exposed to the attack.

About the incident 

Hackers with ties to Pyongyang gained access to the account of a software engineer who oversees the open-source program Axios on Tuesday for at least three hours. According to the report, the attackers used that access to send infected updates to any company that had downloaded the software at the time. This caused the software developer to rush to take back control of his account while cybersecurity executives nationwide attempted to determine the extent of the damage.

The impact 

While the full damage may take months to fix, experts believe that hundreds of thousands of business secrets have already leaked, which can make it one of the worst data breaches. 

About UNC1069

The North Korean group, suspicious of hacking Axios is called UNC1069. Since 2018, the gang has attacked the finance industry. Mandiant believes that the hackers will "try to leverage the credentials and system access they recently obtained in this software supply chain attack to target and steal cryptocurrency from enterprises,"

Why are attacks on the rise from North Korea

Hacking has become a staple of North Korea. The revenue generated from these cyberattacks funds the country’s nuclear and missile programs to the point that these plans are half funded through hacking. In recent years, state-sponsored hackers have stolen billions of dollars from banks and cryptocurrency firms. This includes the infamous (and record-breaking) $1.5 billion crypto theft in 2025 in a single attack. 

Most deadly cyberattack in history

The recent attack was the most advanced supply chain effort to date, cleaning its tracks after installing the payload on the target device. It made detection difficult for developers who unknowingly downloaded the malicious software. Experts say that UNC1069 is not even trying to hide anymore, they just disappears before detection. 

Read more »
UNC1069
Axios Cyber Attacks NPM Package Social Engineering UNC1069

UNC1069 Uses Social Engineering to Hijack Axios npm Package via Maintainer

 



A sophisticated social engineering operation by UNC1069 has led to the compromise of the widely used Axios npm package, raising serious concerns across the JavaScript ecosystem. The attack targeted a member of the Axios project’s maintainer team by masquerading as a legitimate Apache Software Foundation representative, using forged email domains and a fake Jira‑style ticket management system to drive the victim into installing a malicious version of the Axios GitHub Assistant browser extension. 

Once installed, the extension granted UNC1069 broad access to the maintainer’s GitHub account, enabling them to introduce a malicious update to the Axios package and push the compromised code to npm. The attack chain highlights how trusted communication channels—such as seemingly official emails and project‑related ticketing systems—can be weaponized to bypass technical safeguards. By impersonating Apache staff and leveraging the perceived legitimacy of the GitHub Assistant tool, the threat actors manipulated the maintainer into unintentionally installing a malicious browser extension. 

The extension then captured the maintainer’s GitHub cookies and session tokens, which allowed UNC1069 to log in, survey the project, and ultimately publish a malicious version of Axios. This incident underscores that even projects with strong code‑review practices are vulnerable when human‑factor controls and identity‑verification steps are overlooked. Although the malicious Axios package was not directly downloaded more than a handful of times, the episode triggered a sharp spike in removals of older Axios releases from the npm registry. 

This suggests that many developers likely removed the package from projects preemptively to mitigate potential supply‑chain exposure. The fact that the malicious package was quickly removed after detection indicates that npm’s monitoring and incident‑response mechanisms responded promptly; however, the broader damage lies in the erosion of trust and the disruption to downstream projects that depend on Axios. Maintainers and organizations are now forced to revisit their authentication workflows and rethink how they verify communications from partners or foundation staff. A

xios has since published a security update and clarified that the malicious package was an isolated, short‑lived incident in the npm registry. The project’s team has emphasized the importance of using multi‑factor authentication, hardening account security, and limiting third‑party extension access to critical accounts. Security teams are also being advised to audit any browser extensions granted to corporate or critical‑project accounts and to treat unsolicited tools or utilities—especially those tied to “official” infrastructure—as potential red flags. Moving forward, the Axios team is expected to tighten collaboration rules with foundations and external organizations to reduce the risk of similar impersonation‑driven attacks. 

The UNC1069‑Axios incident serves as a stark reminder that software supply‑chain security is only as strong as its weakest human link. Social engineering continues to be a highly effective vector for attackers, especially when paired with technical infrastructure that appears legitimate. For developers and organizations, this event reinforces the need for layered defenses: robust technical safeguards, strict identity‑verification protocols, and continuous security awareness training. As open‑source projects become increasingly central to modern software stacks, protecting maintainers’ accounts and communication channels must be treated with the same urgency as protecting the code itself.
Read more »
UNC1069
malware Mandiant North Korea Hackers phishing UNC1069

North Korean Hackers Deploy New macOS Malware in Crypto Theft Campaign

 

North Korean hackers, tracked as UNC1069 by Google's Mandiant, have deployed sophisticated new macOS malware in targeted cryptocurrency theft campaigns. These attacks leverage AI-generated deepfake videos and social engineering via Telegram to trick victims into executing malicious commands. The operation, uncovered during an investigation into a fintech company breach, highlights the evolving threat to macOS users in the crypto sector.

The malicious campaign begins with hackers compromising a legitimate Telegram account from a crypto executive to build rapport with targets. They direct victims to a spoofed Calendly link leading to a fake Zoom page hosting a deepfake CEO video call. Posing as audio troubleshooting, attackers guide users to run ClickFix-style commands from a webpage, tailored for both macOS and Windows, initiating payload deployment.

Mandiant identified seven distinct macOS malware families in the chain, starting with AppleScript and a malicious Mach-O binary. Key tools include WAVESHAPER, a C++ backdoor for system reconnaissance and C2 communication; HYPERCALL and HIDDENCALL, Golang loaders and backdoors enabling remote access; and SILENCELIFT, a minimal backdoor disrupting Telegram on rooted systems. Newer implants like DEEPBREATH, a Swift data miner bypassing TCC protections to steal keychain, browser, and Telegram data, underscore the attack's breadth.

Additional malware such as SUGARLOADER, a persistent C++ downloader, and CHROMEPUSH, a Chromium extension stealer harvesting credentials and keystrokes, maximize data exfiltration. This unusually high volume of payloads on a single host aims at crypto theft and future social engineering using stolen identities. Detection remains low, with only SUGARLOADER and WAVESHAPER showing VirusTotal flags, emphasizing stealth.

UNC1069, active since 2018, shifted from Web3 targets in 2023 to financial services and crypto infrastructure last year. Similar tactics were seen in 2025 BlueNoroff attacks, but this campaign introduces novel tools amid North Korea's growing macOS focus. Crypto firms must prioritize endpoint detection, deepfake awareness training, and TCC hardening to counter these persistent threats.
Read more »
Subscribe to: Posts (Atom)