- Google Threat Intelligence Group warns of active supply chain attack on npm’s Axios library
- Malicious dependency “plain-crypto-js” deployed WAVESHAPER.V2 backdoor across Windows, macOS, and Linux
- Attribution points to North Korea’s UNC1069 group, known for long-running campaigns targeting cryptocurrency and software developers
North Korean state-sponsored threat actors are targeting a hugely popular npm package in an attempt to infect its users with a malware.
In a security advisory, Google’s Threat Intelligence Group (GTIG) said it was monitoring an “active software supply chain attack” targeting Axios, “the most popular JavaScript library used to simplify HTTP requests”. It simplifies tasks like calling APIs, handling responses, and managing errors compared to using built-in tools like fetch or XMLHttpRequest.
The hackers targeted two versions of the package - 1.14.1 and 0.30.4 - for which Google says typically have over 100 million and 83 million weekly downloads, respectively. They tried to introduce a malicious dependency named "plain-crypto-js", an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux operating systems.
Tying it to North Korea
Google described WAVESHAPER.V2 as a “fully functional RAT”, capable of reconnaissance (extracting telemetry), command execution (in-memory Portable Executable injection and arbitrary shell commands), and system enumeration (returns detailed metadata).
It was written in C++, but other variants were discovered, written in PowerShell and Python, to target different environments.
It is exactly this backdoor that had Google conclude this was a North Korea-sponsored campaign. GTIG said WAVESHAPER.V2 is an updated version of WAVESHAPER, a backdoor that was previously used by a North Korea-nexus threat actor called UNC1069.
“Further, analysis of infrastructure artifacts used in this attack shows overlaps with infrastructure used by UNC1069 in past activities,” Google said.
UNC1069 has apparently been active since at least 2018, making it one of the longer-standing threat actor groups out there. Earlier this year, Mandiant observed it using a combination of compromised Telegram accounts, fake Zoom calls, deepfake videos, and half a dozen malware strains, to target organizations in the cryptocurrency sector and steal their crypto stacks.
