WAVESHAPER

Reported Context (8)

The campaign, attributed to UNC1069, deployed SILKBELL to fetch the WAVESHAPER RAT and led to detections across Windows and macOS with 19 affected eSentire customers; eSentire Reports 19 Customers Affected by Axios npm Supply-Chain Attack
Google TAG attributed the operation to North Korean actor UNC1069 using WAVESHAPER.V2, and maintainers have wiped affected systems, reset credentials, and advised rotating all keys. Fake Teams Update Used to Compromise Axios Maintainer and Push Malicious npm Releases
heavy obfuscation to fetch platform-specific payloads from sfrclak[.]com:8000, exhibited overlap with WAVESHAPER and DPRK-linked activity, and prompted wide mitigations including downgrading Axios and blocking C2 Axios Supply-Chain Attack Deploys Cross-Platform RAT via Malicious npm Dependency
dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows, macOS, and Linux. GTIG Details Axios Supply-Chain Attack Delivering WAVESHAPER.V2 Backdoor
The attackers pushed trojanized Axios releases that installed a malicious dependency “plain-crypto-js” which deployed the SILKBELL dropper and the cross-platform WAVESHAPER.V2 backdoor. Google Attributes Axios npm Supply-Chain Attack to UNC1069

Malware (4)

People (12)

Threat Actors (4)

MITRE ATT&CK (24)

Vendors (10)

Products (14)

Tools (4)

Industries (2)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.