Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
Google Cloud Threat Intelligence (TL-2026-2657), also tracked as TeamPCP Supply Chain Campaign, is a high-severity supply-chain compromise, first published 2026-09-26. It is attributed to UNC1069 (North Korea) with medium confidence, affects axios (OSS maintainers) axios (npm), maps to 14 MITRE ATT&CK techniques (T1027, T1036.001, T1036.005), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-2657
- Threat ID
- TL-2026-2657
- Also known as
- TeamPCP Supply Chain Campaign, DAEMON Tools Supply Chain Attack, Notepad++ Update Infrastructure Compromise, ByBit Heist, axios npm Supply Chain Attack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-26
- Last reviewed
- 2026-09-26
- Attribution
- UNC1069
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, finance, cryptocurrency, government administration, scientificresearch, manufacturing, retail, telecoms, energy, cloudhosting, devops
- Target regions
- Global, North America, south korea, france, russia, belarus, brazil, turkey, thailand, saudi arabia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Google Cloud Threat Intelligence
Malware and tooling: BADFALL, Chrysalis backdoor, Cobalt Strike, QUIC RAT, SANDCLOCK, SLICKDEMON, WAVESHAPER, Cobalt Strike
Google Threat Intelligence Group (GTIG) consolidates five active open-source and software supply-chain compromise campaigns from 2025-2026 -- MIDNIGHT NEPTUNE/UNC1069's axios npm compromise (WAVESHAPER.V2), UNC6780/TeamPCP's GitHub Actions pull_request_target abuse across PyPI/npm/Docker Hub (SANDCLOCK), UNC6863's DAEMON Tools installer trojanization (SLICKDEMON/BADFALL/QUIC RAT), UNC6688's six-month Notepad++ update-infrastructure hijack, and UNC4899/TraderTraitor's $1.4B ByBit Web3 theft -- alongside a reported 1,444% year-over-year surge in malicious open-source packages.
How Google Cloud Threat Intelligence works
This report is a mitigation-guidance rollup published by Google Cloud/GTIG on 2026-07-30 that ties together five distinct, independently-tracked supply-chain intrusions to argue that open-source and software-update supply chains are now a primary initial-access vector for both financially-motivated and espionage-driven intrusion sets.
MIDNIGHT NEPTUNE (formerly UNC1069, DPRK-nexus and financially motivated) compromised the axios npm maintainer account via social engineering and published malicious axios versions 1.14.1 and 0.30.4 during a three-hour window on 2026-03-31 (00:21-03:20 UTC). The releases carried a phantom dependency, plain-crypto-js 4.2.1, whose postinstall hook ran the obfuscated SILKBELL JavaScript dropper (setup.js). SILKBELL fetched and executed platform-specific stagers -- a disguised PowerShell copy (wt.exe) on Windows, a Mach-O binary at /Library/Caches/com.apple.act.mond on macOS, and a Python backdoor at /tmp/ld.py on Linux -- all deploying the WAVESHAPER.V2 backdoor, which beacons every 60 seconds over HTTP to sfrclak[.]com:142.11.206.73:8000 using a spoofed IE8/Trident User-Agent. Because axios has 100M+ weekly downloads and tens of thousands of dependents, the compromise reached at least 15 industry verticals across 13 countries before GTIG-supported customers pulled the packages within three hours.
UNC6780 (aka TeamPCP, PCPcat, ShellForce, DeadCatx3, CanisterWorm) ran a sustained February-May 2026 campaign abusing the GitHub Actions pull_request_target trigger to obtain base-repository secrets and write access, then published the SANDCLOCK credential stealer through compromised packages on PyPI, npm, and Docker Hub (Aqua Security Trivy Action v0.69.4-v0.69.6 in March; LiteLLM and Telnyx Python SDK on PyPI; Bitwarden CLI npm @2026.4.0 and a re-compromised Checkmarx KICS Docker Hub image in April; a Nx Console VS Code Marketplace extension breach against GitHub's own infrastructure in May exfiltrating roughly 3,800 repositories). SANDCLOCK disguises its exfiltration as legitimate telemetry POST traffic to monitoring-service-styled domains, scraping CI runner memory for AWS keys, GitHub tokens, Kubernetes configs, and SSH private keys for direct sale or ransomware-affiliate handoff.
UNC6863 trojanized official DAEMON Tools Lite Windows installers (versions 12.5.0.2421-12.5.0.2434, signed with valid AVB Disc Soft certificates) starting 2026-04-08, tampering with DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. An initial implant beacons to env-check.daemontools[.]cc (registered 2026-03-27) and, on a small, deliberately filtered subset of the thousands of infected hosts, drops SLICKDEMON for reconnaissance/target-filtering, the shellcoded loader BADFALL for hands-on-keyboard access, and the highly obfuscated, WolfSSL-linked QUIC RAT (which injects into notepad.exe/conhost.exe and supports HTTP, UDP, TCP, WSS, QUIC, DNS and HTTP/3 C2). Despite thousands of infection attempts across 100+ countries, only a dozen hosts received second-stage tooling, concentrated against government, scientific, and manufacturing targets in Russia, Belarus, Brazil, Turkey, and Thailand.
UNC6688 compromised the shared hosting infrastructure serving notepad-plus-plus.org's WinGUP (GUP.exe) update mechanism from June to December 2025, redirecting update traffic so WinGUP spawned a malicious AutoUpdater.exe. Direct server access was cut by a hosting-provider kernel/firmware update on 2025-09-02, but the actor retained internal-service credentials and continued manipulating update traffic until 2025-12-02, delivering the Chrysalis backdoor (custom API hashing, Microsoft Warbird protection) and, via a Lua-script-injection variant, Cobalt Strike Beacon to selected targets in South Korea and France. Independent researchers (Unit 42) separately attribute this cluster to the China-nexus actor Lotus Blossom.
UNC4899, overlapping with the DPRK clusters tracked elsewhere as Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor (Lazarus Group), executed the 2025-02-21 ByBit theft: a compromised developer workstation at a Web3 organization was used to inject malicious JavaScript into the Safe{Wallet} multisig signing interface, tricking authorized signers into approving a transaction that redirected roughly $1.4-1.5B in cryptocurrency to actor-controlled wallets, subsequently laundered across thousands of addresses on multiple blockchains.
GTIG frames all five clusters as evidence of a systemic shift and, citing OSSF data showing a 1,444% year-over-year increase in malicious open-source packages, issues administrative (SBOM/ABOM, SDLC threat modeling), package-manager (release-age cooldowns, lifecycle-script sandboxing), identity (OIDC federation, FIDO2 SSH, PAT lifespan limits), infrastructure (ephemeral CI runners, artifact-repo mirroring, code-signing HSMs), and monitoring (SCA/OSV-Scanner, egress baselining, ATO detection for maintainer accounts) mitigation guidance.
MITRE ATT&CK techniques used in TL-2026-2657
Defense Evasion
T1027 Obfuscated Files or Information; T1036.001 Invalid Code Signature; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection
Discovery
Execution
Command and Control
Initial Access
T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1552.001 Credentials In Files
defense-impairment
Affected products and versions in Google Cloud Threat Intelligence
- axios (OSS maintainers) — axios (npm)
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: 1.14.0 or 1.6.8+; 0.30.3 or 0.28.1+ - npm ecosystem (malicious package) — plain-crypto-js
Vulnerable versions: 4.2.0; 4.2.1 - Disc Soft Ltd (AVB Disc Soft) — DAEMON Tools Lite
Vulnerable versions: 12.5.0.2421; 12.5.0.2434; range 12.5.0.2421-12.5.0.2434
Fixed in: 12.6.0.2445 - Notepad++ project / third-party hosting provider — Notepad++ update distribution (WinGUP / GUP.exe)
Vulnerable versions: update hosting infrastructure, June-December 2025
Fixed in: hosting infrastructure remediated, effective December 2025 - Safe (Safe Ecosystem Foundation) — Safe{Wallet} web frontend
Vulnerable versions: frontend JavaScript served February 2025
Fixed in: frontend remediated post-incident - Multiple OSS maintainers — Aqua Security Trivy Action, Bitwarden CLI (npm), Checkmarx KICS (Docker Hub), Nx Console (VS Code Marketplace), LiteLLM (PyPI), Xinference (PyPI), Telnyx Python SDK (PyPI)
Vulnerable versions: Trivy Action v0.69.4-v0.69.6; Bitwarden CLI @2026.4.0; various, February-May 2026
Fixed in: patched or removed by respective maintainers post-disclosure
Remediation for Google Cloud Threat Intelligence
Patches
- Upgrade axios to 1.14.0/1.6.8 or later, or 0.30.3/0.28.1 or later; remove any node_modules/plain-crypto-js/ directory entirely
- Upgrade DAEMON Tools Lite to 12.6.0.2445 or later
- Confirm Notepad++ auto-update infrastructure has completed the vendor's post-incident hosting remediation (effective December 2025)
- Update or remove TeamPCP/UNC6780-compromised packages: Aqua Security Trivy Action, Bitwarden CLI npm package, Checkmarx KICS Docker Hub image, Nx Console VS Code extension, LiteLLM and Telnyx Python SDKs on PyPI
Immediate actions
- Block C2 indicators: sfrclak[.]com, 142.11.206.73, 23.254.167.216, env-check.daemontools[.]cc, skycloudcenter[.]com, self-dns[.]it[.]com, safe-dns[.]it[.]com, cdncheck[.]it[.]com, and the listed Notepad++ update-infrastructure IPs
- Audit lockfiles/dependency trees for plain-crypto-js 4.2.0-4.2.1 and axios 1.14.1/0.30.4; purge npm/yarn/pnpm caches on affected hosts
- Treat any host that ran a compromised installer or update (DAEMON Tools 12.5.0.2421-12.5.0.2434, Notepad++ AutoUpdater.exe) as fully compromised and rebuild from clean media
- Rotate all CI/CD and developer secrets (AWS keys, GitHub PATs, Kubernetes configs, SSH private keys) on any runner or workstation that executed a flagged package or installer
- Disable or heavily restrict the pull_request_target GitHub Actions trigger on public repositories; strip secrets access and require maintainer approval for external-collaborator PR-triggered workflows
Workarounds
- Pin dependencies to known-clean versions and enforce lockfile integrity verification in CI before every build
- Disable npm/pip lifecycle scripts by default (npm: allowScripts=false / --ignore-scripts; pip: --no-binary with script review) until new package versions are vetted
- Enforce a minimum package release-age cooldown (24 hours for npm, 14 days for PyPI) before automated tooling can pull a new version
- Route all package installs through an internal proxy or private registry mirror rather than pulling directly from public registries
Longer-term hardening
- Adopt automated SBOM and Action Bill of Materials (ABOM) generation with continuous cross-referencing against disclosed vulnerabilities and known-malicious packages
- Migrate CI/CD system identities from static, long-lived PATs to short-lived OIDC-federated tokens and scoped GitHub Apps
- Mandate FIDO2 hardware-backed SSH for git operations and disable classic Personal Access Tokens organization-wide
- Deploy EDR across developer workstations and CI runners tuned to detect npm/pip postinstall-script abuse and unexpected outbound telemetry-mimicking traffic
- Implement Google Assured Open Source Software (AOSS) or equivalent provenance-signing to raise trust levels on third-party dependencies
Weaknesses (CWE) in Google Cloud Threat Intelligence
CWE-829, CWE-494, CWE-506
Timeline of Google Cloud Threat Intelligence
- UNC4899/TraderTraitor injects malicious JavaScript into the Safe{Wallet} multisig signing interface, tricking authorized signers at ByBit into approving a transaction that results in the theft of approximately $1.4-1.5B in cryptocurrency.
- UNC6688 (separately attributed by Unit 42 to Lotus Blossom) compromises the shared hosting infrastructure serving Notepad++'s WinGUP update mechanism, beginning a six-month campaign.
- A hosting-provider kernel and firmware update severs UNC6688's direct server access to the Notepad++ update infrastructure; retained internal-service credentials allow continued manipulation.
- UNC6688's remaining access to Notepad++ internal hosting services is cut off, ending the update-infrastructure compromise.
- FBI and IC3 publish a joint PSA formally attributing the ByBit theft to North Korea (TraderTraitor) and listing approximately 50 Ethereum wallet addresses used in laundering.
- UNC6780/TeamPCP compromises the Aqua Security Trivy GitHub Action (versions 0.69.4-0.69.6), deploying the SANDCLOCK credential stealer across more than 10,000 CI/CD runs.
- The C2 domain env-check.daemontools[.]cc is registered ahead of the DAEMON Tools installer compromise.
- MIDNIGHT NEPTUNE/UNC1069 publishes malicious axios versions 1.14.1 and 0.30.4 bundling the plain-crypto-js 4.2.1 dropper, deploying WAVESHAPER.V2 to Windows, macOS, and Linux targets during a three-hour window (00:21-03:20 UTC) before removal.
- UNC6863 begins trojanizing official DAEMON Tools Lite installers (versions 12.5.0.2421-12.5.0.2434) distributed from the legitimate vendor website.
- UNC6780/TeamPCP conducts concurrent compromises of the Bitwarden CLI npm package and a re-compromised Checkmarx KICS Docker Hub image.
- The DAEMON Tools supply-chain compromise is publicly disclosed, with thousands of recorded infection attempts across 100+ countries and second-stage QUIC RAT delivery limited to roughly a dozen targeted hosts.
- UNC6780/TeamPCP breaches GitHub's internal infrastructure via a trojanized Nx Console VS Code Marketplace extension, exfiltrating approximately 3,800 repositories over an 18-minute window.
- Google Cloud Threat Intelligence Group publishes consolidated mitigation guidance covering all five campaigns, citing a 1,444% year-over-year increase in identified malicious open-source packages.
Sources cited for Google Cloud Threat Intelligence
- Mitigation guidance for supply chain compromise
- North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack
- Axios npm Supply Chain Attack FAQ: North Korea UNC1069
- What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing
- TeamPCP (UNC6780): AI Supply Chain's Most Active Threat Actor
- TeamPCP: the supply chain attack story so far
- TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises
- DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
- Popular DAEMON Tools software compromised
- Nation-State Actors Exploit Notepad++ Supply Chain
- Notepad++ Supply Chain Compromise FAQ
- Notepad++ Hijacked by State-Sponsored Hackers
- North Korea Responsible for $1.5 Billion Bybit Hack
- North Korea Responsible for $1.5 Billion Bybit Hack (PSA)
More in supply chain
- Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload
- Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules to Deliver Go RAT with Slack and Arbitrum Sepolia Blockchain C2
- GHAPPIER Loader: npm Trusted-Publishing Abuse Compromises @dforge-core/dforge-mcp
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)
Detection coverage for TL-2026-2657
As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2657 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2657
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.