cyber.hendryadrian.com
YouTube · Hak5

Supply-Chain Attacks Compromise Axios Releases and Cisco Development Credentials

· 3:00 · Watch on YouTube ↗

Summary

The video reports that malicious packages were published through compromised Axios releases and that Team PCP used stolen credentials and AWS keys in attacks involving Cisco development environments. It warns that stolen secrets could enable further compromises.

Key points

  • The transcript says Team PCP used credentials to infiltrate GitHub Actions, Docker Hub, NPM, Open VSX, and PyPI, and links its Trivy incident to a Cisco data breach.
  • Cisco build and development environment credentials and data, along with AWS keys, were reportedly obtained; the keys were then used for unauthorized activity across Cisco AWS accounts.
  • Axios versions 1.14.1 and 0.30.4 were released with the plain-dash-crypto-js 4.2.1 package, which the transcript says was confirmed malicious.
  • The package reportedly deployed a multi-stage payload capable of arbitrary command execution and data exfiltration.
  • The project lead maintainer's account was reportedly compromised; attackers changed its email and used the account to remove warnings about the package.
  • The video relays Google researchers' warning that stolen secrets could enable further supply-chain and SaaS compromises, downstream customer impacts, ransomware, extortion, and cryptocurrency theft.
  • The presenter recommends considering rotation of secrets associated with public NPM packages and other public projects.

Article Details

Topics
  • [00:00] Team PCP's credential-based intrusions and the reported Cisco breach
  • [00:45] Malicious Axios package releases and the compromised maintainer account
  • [02:07] Researchers' warning about stolen secrets and downstream risks
  • [02:36] Recommendation to rotate secrets associated with public packages

MITRE ATT&CK

T1078 · Valid AccountsThe transcript says Team PCP used credentials to infiltrate software development and package platforms, consistent with use of valid accounts.

Threat Actors

TeamPCPThe transcript reports that Team PCP used credentials to infiltrate several software platforms and links the group to the Trivy incident associated with a Cisco breach.

Vendors

CiscoThe transcript reports a data breach involving Cisco build and development environments and AWS keys used for unauthorized activity across Cisco AWS accounts.

Products

Docker HubThe transcript says Team PCP used credentials to infiltrate Docker Hub.Open VSXThe transcript says Team PCP used credentials to infiltrate Open VSX.

Countries

North KoreaThe Axios attack was thought to involve a financially motivated attacker group based in North Korea; the transcript presents this attribution as tentative.

Related Articles