'Hundreds of thousands of stolen secrets could potentially be circulating as a result of these recent attacks': Google says North Korean hackers behind major attack on Axios

• Google Threat Intelligence Group warns of active supply chain attack on npm’s Axios library
• Malicious dependency “plain-crypto-js” deployed WAVESHAPER.V2 backdoor across Windows, macOS, and Linux
• Attribution points to North Korea’s UNC1069 group, known for long-running campaigns targeting cryptocurrency and software developers

North Korean state-sponsored threat actors are targeting a hugely popular npm package in an attempt to infect its users with a malware.

In a security advisory, Google’s Threat Intelligence Group (GTIG) said it was monitoring an “active software supply chain attack” targeting Axios, “the most popular JavaScript library used to simplify HTTP requests”. It simplifies tasks like calling APIs, handling responses, and managing errors compared to using built-in tools like fetch or XMLHttpRequest.

The hackers targeted two versions of the package - 1.14.1 and 0.30.4 - for which Google says typically have over 100 million and 83 million weekly downloads, respectively. They tried to introduce a malicious dependency named "plain-crypto-js", an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux operating systems.

Tying it to North Korea

Google described WAVESHAPER.V2 as a “fully functional RAT”, capable of reconnaissance (extracting telemetry), command execution (in-memory Portable Executable injection and arbitrary shell commands), and system enumeration (returns detailed metadata).

It was written in C++, but other variants were discovered, written in PowerShell and Python, to target different environments.

It is exactly this backdoor that had Google conclude this was a North Korea-sponsored campaign. GTIG said WAVESHAPER.V2 is an updated version of WAVESHAPER, a backdoor that was previously used by a North Korea-nexus threat actor called UNC1069.

“Further, analysis of infrastructure artifacts used in this attack shows overlaps with infrastructure used by UNC1069 in past activities,” Google said.

UNC1069 has apparently been active since at least 2018, making it one of the longer-standing threat actor groups out there. Earlier this year, Mandiant observed it using a combination of compromised Telegram accounts, fake Zoom calls, deepfake videos, and half a dozen malware strains, to target organizations in the cryptocurrency sector and steal their crypto stacks.

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.