Malware
SILKBELL
- First Reported
- Apr 1, 2026
- Latest Reported
- Apr 11, 2026
Reported Context (4)
- The campaign, attributed to UNC1069, deployed SILKBELL to fetch the WAVESHAPER RAT and led to detections across Windows and macOS with 19 affected eSentire customers; eSentire Reports 19 Customers Affected by Axios npm Supply-Chain Attack
- NPM package where a malicious dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows, macOS, and Linux. GTIG Details Axios Supply-Chain Attack Delivering WAVESHAPER.V2 Backdoor
- The attackers pushed trojanized Axios releases that installed a malicious dependency “plain-crypto-js” which deployed the SILKBELL dropper and the cross-platform WAVESHAPER.V2 backdoor. Google Attributes Axios npm Supply-Chain Attack to UNC1069
- and 0.30.4) on March 31, using a postinstall hook that executed an obfuscated dropper (tracked as SILKBELL) to deploy platform-specific payloads. Threat Firms Attribute Axios npm Supply-Chain Attack to Lazarus Group
Malware (4)
People (4)
Threat Actors (5)
MITRE ATT&CK (21)
Vendors (3)
Products (3)
Tools (4)
Industries (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.