Threat video1:00
TeamPCP Poisoning and axios npm Hijack: Detection & IOCs
TeamPCP poisoned PyPI, npm and GitHub Actions packages with SANDCLOCK. It maps 28 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for TeamPCP Poisoning and axios npm Hijack: Detection & IOCs →
Chapters
- 0:00The hookMalicious open-source packages rose 1,444%.
- 0:06The storyOperators hijacked an axios maintainer.
- 0:12Attack pathA maintainer account was social-engineered.
- 0:26AttributionAttributed to UNC6780.
- 0:32Indicators of compromise25 indicators to hunt: 2 IPs, 1 domain and 1 URL, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Search all lockfiles for axios.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malicious open-source packages rose 1,444%.
0:06Operators hijacked an axios maintainer.
0:09Live about three hours.
0:12A maintainer account was social-engineered.
0:15Trojanized releases ran a postinstall hook.
0:18Windows, macOS, Linux got different malware.
0:21A backdoor beaconed to attackers.
0:26Attributed to UNC6780. Confidence: medium.
0:3225 indicators to hunt: 2 IPs, 1 domain and 1 URL, and more.
0:3918 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Search all lockfiles for axios.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.