# UNC1069 Compromises Axios NPM Package in Supply Chain Attack Deploying WAVESHAPER.V2 Cross-Platform Backdoor

> North Korea-nexus threat actor UNC1069 compromised the widely-used Axios NPM package (183M+ weekly downloads) by hijacking a maintainer account and injecting a malicious dependency 'plain-crypto-js' into versions 1.14.1 and 0.30.4. The obfuscated SILKBELL dropper deploys WAVESHAPER.V2, a cross-platform RAT with C2 beaconing, process injection, and remote command execution capabilities.

- **Published:** 2026-04-01T12:00:00Z
- **Last reviewed:** 2026-04-01T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0309
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-waveshaper-v2-backdoor-tl-2026-0309.webp?v=492993ca (Threadlinqs threat intel: WAVESHAPER.V2 Axios npm Backdoor: Detection & IOCs (TL-2026-0309) — Critical severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-0309
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

UNC1069, a North Korea-nexus financially-motivated threat actor active since at least 2018, executed one of the most operationally sophisticated supply chain attacks ever documented against the NPM ecosystem. The attack targeted Axios, a top-10 NPM package with over 183 million weekly downloads used across frontend frameworks, backend services, and enterprise applications worldwide.

The attack began on March 31, 2026, when UNC1069 compromised the lead Axios maintainer's NPM account, gaining elevated permissions that exceeded those of project collaborators and preventing immediate access revocation. Using this access, the attacker published two malicious versions — axios@1.14.1 and axios@0.30.4 — that introduced a new dependency called 'plain-crypto-js' containing the malicious payload. Critically, there were zero lines of malicious code inside axios itself, making detection extremely difficult.

The malicious 'plain-crypto-js' package contained SILKBELL, an obfuscated JavaScript dropper (setup.js) triggered via npm's postinstall hook. Upon package installation, npm automatically executed the obfuscated JavaScript code in the background. SILKBELL fetches OS-specific payloads from the C2 infrastructure, deploying platform-appropriate variants of the WAVESHAPER.V2 backdoor. After successful execution, the dropper self-cleans by deleting itself and replacing files with legitimate axios code, leaving minimal forensic traces.

WAVESHAPER.V2 is a cross-platform remote access trojan (RAT) with three platform-specific implementations: a C++ Mach-O binary for macOS, a PowerShell variant for Windows, and a Python variant for Linux. The backdoor communicates with its C2 server at sfrclak[.]com (resolving to 142.11.206.73) using JSON-based HTTP protocol with 60-second polling intervals. The RAT supports four primary commands: 'kill' (self-termination), 'rundir' (directory enumeration), 'runscript' (arbitrary command execution), and 'peinject' (process injection for persistence and evasion).

On macOS, the malware stages its payloads in /Library/Caches/com.apple.act.mond, disguising itself as a legitimate Apple system process. Developer build path artifacts ('Jain_DEV/client_mac/macWebT/macWebT') found in the macOS binary link this attack to BlueNoroff's 'webT' module observed in 2023 RustBucket campaigns, providing strong attribution evidence. The C2 infrastructure was accessed via an AstrillVPN node previously linked to UNC1069 operations.

The attack window lasted approximately 3 hours (00:21 UTC to 03:20 UTC on March 31, 2026) before the malicious packages were detected and removed. Despite the short window, the massive download volume of Axios means potentially thousands of CI/CD pipelines and developer environments were exposed. The attacker used the email address ifstap@proton.me for the malicious package registration.

Google Threat Intelligence Group (GTIG), SentinelOne, and other researchers confirmed attribution to UNC1069, which has historical ties to BlueNoroff and has been involved in cryptocurrency theft operations using social engineering tactics including fake Zoom meetings. This attack represents a significant escalation in capability — moving from targeted social engineering to mass-scale software supply chain compromise.

## MITRE ATT&CK

- T1587.001 Malware
- T1585.002 Email Accounts
- T1588.002 Tool
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.006 Python
- T1204.002 Malicious File
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WAVESHAPER.V2 Persistence and Staging Artifacts — Post-Exploitation Phase** (`TL-2026-0309-SPL-002`)

Detects WAVESHAPER.V2 post-exploitation persistence mechanisms including Windows Registry Run key creation for autostart, creation of masquerading staging directories (com.apple.act.mond pattern), and process injection activity. Also detects self-cleaning behavior where the dropper removes itself after payload deployment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547, T1036.005, T1070.004, T1055
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=13 TargetObject="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*" Details="*\\Temp\\*") OR (EventCode=11 TargetFilename="*com.apple.act.mond*") OR (EventCode=1 Image="*\\powershell.exe" CommandLine="*-WindowStyle Hidden*" CommandLine="*\\Temp\\*") OR (EventCode=23 TargetFilename="*setup.js*" Image="*\\node.exe*")) | eval detection_phase=case(EventCode=13, "registry_persistence", EventCode=11 AND match(TargetFilename, "com.apple.act.mond"), "masquerading_staging", EventCode=1, "hidden_powershell", EventCode=23, "dropper_selfclean") | table _time, Computer, User, EventCode, detection_phase, Image, TargetObject, TargetFilename, CommandLine | sort _time
```

### Microsoft KQL

```kql
union DeviceRegistryEvents, DeviceFileEvents, DeviceProcessEvents | where Timestamp > ago(24h) | where (ActionType == "RegistryValueSet" and RegistryKey has "CurrentVersion\\Run" and RegistryValueData has "\\Temp\\") or (ActionType in ("FileCreated", "FileModified") and FolderPath has "com.apple.act.mond") or (FileName =~ "powershell.exe" and ProcessCommandLine has "-WindowStyle Hidden" and ProcessCommandLine has "\\Temp\\") or (ActionType == "FileDeleted" and FileName == "setup.js" and InitiatingProcessFileName =~ "node.exe") | extend DetectionPhase = case(ActionType == "RegistryValueSet", "registry_persistence", FolderPath has "com.apple.act.mond", "masquerading_staging", FileName =~ "powershell.exe", "hidden_powershell", ActionType == "FileDeleted", "dropper_selfclean", "unknown") | project Timestamp, DeviceName, AccountName, ActionType, DetectionPhase, FileName, FolderPath, RegistryKey, ProcessCommandLine | sort by Timestamp asc
```

### Sigma

```yaml
title: WAVESHAPER.V2 Persistence and Staging Artifacts
id: 3c9e7a2d-1b8f-4d6e-a5c3-8f2e1d0b4a6c
status: experimental
description: Detects WAVESHAPER.V2 RAT post-exploitation persistence mechanisms including Registry Run key creation, masquerading staging directory creation, hidden PowerShell execution from temp directories, and SILKBELL dropper self-cleaning
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
author: Threadlinqs Team
date: 2026/04/01
tags:
    - attack.persistence
    - attack.t1547
    - attack.defense_evasion
    - attack.t1036.005
    - attack.t1070.004
    - attack.t1055
logsource:
    product: windows
    category: process_creation
detection:
    selection_registry:
        EventType: SetValue
        TargetObject|contains: '\\CurrentVersion\\Run\\'
        Details|contains: '\\Temp\\'
    selection_masquerade:
        TargetFilename|contains: 'com.apple.act.mond'
    selection_hidden_ps:
        Image|endswith: '\\powershell.exe'
        CommandLine|contains|all:
            - '-WindowStyle Hidden'
            - '\\Temp\\'
    selection_selfclean:
        Image|endswith: '\\node.exe'
        TargetFilename|endswith: 'setup.js'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software using Registry Run keys for autostart
    - Apple software on Windows creating com.apple cache directories
level: high
```

**Tuning notes:** Exclude known legitimate applications that write Run keys from Temp directories. Whitelist Apple iTunes/iCloud cache paths if present in your environment. For the hidden PowerShell detection, add exclusions for your endpoint management tools that may use hidden windows.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SILKBELL Dropper Execution via NPM Lifecycle Hook — Exploitation Phase (locked: unlock with TL Creds)
- WAVESHAPER.V2 Process Injection and Persistence Mechanisms — Post-Exploitation Phase (locked: unlock with TL Creds)
- WAVESHAPER.V2 C2 Network Communication and System Discovery — C2 Phase (locked: unlock with TL Creds)
- SILKBELL Supply Chain Dropper — Obfuscated JavaScript Payload Fetch — Exploitation Phase (locked: unlock with TL Creds)
- WAVESHAPER.V2 Cross-Platform Persistence and Defense Evasion — Post-Exploitation Phase (locked: unlock with TL Creds)
- WAVESHAPER.V2 JSON-HTTP C2 Protocol and Ingress Tool Transfer — C2 Phase (locked: unlock with TL Creds)
- SILKBELL NPM Postinstall Dropper Execution — Exploitation Phase (locked: unlock with TL Creds)
- WAVESHAPER.V2 C2 Beaconing and RAT Command Execution — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `142.11.206[.]73`
- Domain: `sfrclak[.]com`
- Email address: `ifstap[@]proton[.]me`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GTIG: North Korea-Nexus Threat Actor Targets Axios NPM Package](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Malpedia: OSX.WAVESHAPER Analysis](https://malpedia.caad.fkie.fraunhofer.de/library/328e2aff-077e-478e-9e99-a08a317804f8/)
- [TheHackerNews: Google Attributes Axios npm Supply Chain Attack to UNC1069](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html)
- [HelpNetSecurity: North Korean Hackers Linked to Axios npm Supply Chain Compromise](https://www.helpnetsecurity.com/2026/04/01/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise/)
- [SecurityWeek: Axios NPM Package Breached in North Korean Supply Chain Attack](https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/)
- [The Record: Google Links Axios Supply Chain Attack to North Korean Group](https://therecord.media/google-links-axios-supply-chain-attack-north-korea)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0309