Threat Actor
Sapphire Sleet
- First Reported
- Apr 20, 2026
- Latest Reported
- Oct 7, 2026
Reported Context (4)
- The article identifies Sapphire Sleet as another name for Alluring Pisces and associates the actor with recent attributed supply-chain campaigns. Supply-Chain Malware Uses Blockchain Transactions for Resilient Command and Control
- The article assesses the association at low confidence, citing infrastructure links reported by Wiz. Rust Supply-Chain Attack Delivers macOS Rustbot RAT to Steal Credentials
- Microsoft attributed the Mastra campaign, which shared a C2 endpoint pattern with this incident, to DPRK / Sapphire Sleet; the article does not attribute the Rust crate attack to Sapphire Sleet. Malicious Rust Crates Deliver Backdoor Through Build Scripts
- Microsoft attributed the axios npm supply-chain compromise to this actor, described in the article as North Korean state-sponsored. Vercel Breach Traced to Stolen OAuth Tokens, Exposing Environment Variables in Compromised Teams
CVE (1)
Malware (4)
People (2)
Threat Actors (6)
MITRE ATT&CK (29)
Vendors (10)
Products (34)
Tools (2)
Industries (2)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.