# Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)

> Google Threat Intelligence Group (GTIG) consolidates five active open-source and software supply-chain compromise campaigns from 2025-2026 -- MIDNIGHT NEPTUNE/UNC1069's axios npm compromise (WAVESHAPER.V2), UNC6780/TeamPCP's GitHub Actions pull_request_target abuse across PyPI/npm/Docker Hub (SANDCLOCK), UNC6863's DAEMON Tools installer trojanization (SLICKDEMON/BADFALL/QUIC RAT), UNC6688's six-month Notepad++ update-infrastructure hijack, and UNC4899/TraderTraitor's $1.4B ByBit Web3 theft -- alongside a reported 1,444% year-over-year surge in malicious open-source packages.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2657
- **ID:** TL-2026-2657
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This report is a mitigation-guidance rollup published by Google Cloud/GTIG on 2026-07-30 that ties together five distinct, independently-tracked supply-chain intrusions to argue that open-source and software-update supply chains are now a primary initial-access vector for both financially-motivated and espionage-driven intrusion sets.

MIDNIGHT NEPTUNE (formerly UNC1069, DPRK-nexus and financially motivated) compromised the axios npm maintainer account via social engineering and published malicious axios versions 1.14.1 and 0.30.4 during a three-hour window on 2026-03-31 (00:21-03:20 UTC). The releases carried a phantom dependency, plain-crypto-js 4.2.1, whose postinstall hook ran the obfuscated SILKBELL JavaScript dropper (setup.js). SILKBELL fetched and executed platform-specific stagers -- a disguised PowerShell copy (wt.exe) on Windows, a Mach-O binary at /Library/Caches/com.apple.act.mond on macOS, and a Python backdoor at /tmp/ld.py on Linux -- all deploying the WAVESHAPER.V2 backdoor, which beacons every 60 seconds over HTTP to sfrclak[.]com:142.11.206.73:8000 using a spoofed IE8/Trident User-Agent. Because axios has 100M+ weekly downloads and tens of thousands of dependents, the compromise reached at least 15 industry verticals across 13 countries before GTIG-supported customers pulled the packages within three hours.

UNC6780 (aka TeamPCP, PCPcat, ShellForce, DeadCatx3, CanisterWorm) ran a sustained February-May 2026 campaign abusing the GitHub Actions pull_request_target trigger to obtain base-repository secrets and write access, then published the SANDCLOCK credential stealer through compromised packages on PyPI, npm, and Docker Hub (Aqua Security Trivy Action v0.69.4-v0.69.6 in March; LiteLLM and Telnyx Python SDK on PyPI; Bitwarden CLI npm @2026.4.0 and a re-compromised Checkmarx KICS Docker Hub image in April; a Nx Console VS Code Marketplace extension breach against GitHub's own infrastructure in May exfiltrating roughly 3,800 repositories). SANDCLOCK disguises its exfiltration as legitimate telemetry POST traffic to monitoring-service-styled domains, scraping CI runner memory for AWS keys, GitHub tokens, Kubernetes configs, and SSH private keys for direct sale or ransomware-affiliate handoff.

UNC6863 trojanized official DAEMON Tools Lite Windows installers (versions 12.5.0.2421-12.5.0.2434, signed with valid AVB Disc Soft certificates) starting 2026-04-08, tampering with DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. An initial implant beacons to env-check.daemontools[.]cc (registered 2026-03-27) and, on a small, deliberately filtered subset of the thousands of infected hosts, drops SLICKDEMON for reconnaissance/target-filtering, the shellcoded loader BADFALL for hands-on-keyboard access, and the highly obfuscated, WolfSSL-linked QUIC RAT (which injects into notepad.exe/conhost.exe and supports HTTP, UDP, TCP, WSS, QUIC, DNS and HTTP/3 C2). Despite thousands of infection attempts across 100+ countries, only a dozen hosts received second-stage tooling, concentrated against government, scientific, and manufacturing targets in Russia, Belarus, Brazil, Turkey, and Thailand.

UNC6688 compromised the shared hosting infrastructure serving notepad-plus-plus.org's WinGUP (GUP.exe) update mechanism from June to December 2025, redirecting update traffic so WinGUP spawned a malicious AutoUpdater.exe. Direct server access was cut by a hosting-provider kernel/firmware update on 2025-09-02, but the actor retained internal-service credentials and continued manipulating update traffic until 2025-12-02, delivering the Chrysalis backdoor (custom API hashing, Microsoft Warbird protection) and, via a Lua-script-injection variant, Cobalt Strike Beacon to selected targets in South Korea and France. Independent researchers (Unit 42) separately attribute this cluster to the China-nexus actor Lotus Blossom.

UNC4899, overlapping with the DPRK clusters tracked elsewhere as Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor (Lazarus Group), executed the 2025-02-21 ByBit theft: a compromised developer workstation at a Web3 organization was used to inject malicious JavaScript into the Safe{Wallet} multisig signing interface, tricking authorized signers into approving a transaction that redirected roughly $1.4-1.5B in cryptocurrency to actor-controlled wallets, subsequently laundered across thousands of addresses on multiple blockchains.

GTIG frames all five clusters as evidence of a systemic shift and, citing OSSF data showing a 1,444% year-over-year increase in malicious open-source packages, issues administrative (SBOM/ABOM, SDLC threat modeling), package-manager (release-age cooldowns, lifecycle-script sandboxing), identity (OIDC federation, FIDO2 SSH, PAT lifespan limits), infrastructure (ephemeral CI runners, artifact-repo mirroring, code-signing HSMs), and monitoring (SCA/OSV-Scanner, egress baselining, ATO detection for maintainer accounts) mitigation guidance.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1036.001 Invalid Code Signature
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1055 Process Injection
- T1552.001 Credentials In Files
- T1057 Process Discovery
- T1071.001 Web Protocols

## Sources

- [Mitigation guidance for supply chain compromise](https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/)
- [North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Axios npm Supply Chain Attack FAQ: North Korea UNC1069](https://www.tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069)
- [What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing](https://www.sans.org/blog/what-we-learned-axios-npm-supply-chain-compromise-emergency-briefing)
- [TeamPCP (UNC6780): AI Supply Chain's Most Active Threat Actor](https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-unc6780-ai-developer-supply-chain/)
- [TeamPCP: the supply chain attack story so far](https://teampcp.pluto.security/the-full-story/)
- [TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises](https://isc.sans.edu/diary/32926)
- [DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware](https://thehackernews.com/2026/05/daemon-tools-supply-chain-attack.html)
- [Popular DAEMON Tools software compromised](https://securelist.com/tr/daemon-tools-backdoor/119654/)
- [Nation-State Actors Exploit Notepad++ Supply Chain](https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/)
- [Notepad++ Supply Chain Compromise FAQ](https://www.tenable.com/blog/frequently-asked-questions-about-notepad-supply-chain-compromise)
- [Notepad++ Hijacked by State-Sponsored Hackers](https://notepad-plus-plus.org/news/hijacked-incident-info-update/)
- [North Korea Responsible for $1.5 Billion Bybit Hack](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack)
- [North Korea Responsible for $1.5 Billion Bybit Hack (PSA)](https://www.ic3.gov/psa/2025/psa250226)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2657