Axios RAT: SANS Incident Response Playbook, Qualys Detection IDs, and the TeamPCP IAB Theory

Analysis

SANS Axios Supply Chain Briefing: Full IR Checklist and TeamPCP Initial Access Broker Theory

SANS lays out a concrete incident response checklist with specific artifact paths per OS and flags the TeamPCP IAB hypothesis, suggesting the attackers may be selling access rather than exploiting it directly. If that theory holds, expect more compromised publishing credentials to surface across npm and PyPI in the coming weeks.

Trend Micro Axios Deep Dive: C2 Infrastructure Timeline, Anti-Forensics Mechanics, and In-Memory Windows Payload

Trend Micro reconstructs the 18-hour pre-staging window and confirms the C2 domain was registered just 10 hours before the malicious payload went live on a commodity Namecheap host. The Windows payload executes the final stage entirely in memory via scriptblock, leaving no disk artifact beyond wt.exe, which is the most evasion-focused design detail published so far.

Datadog Security Labs: Registry Metadata Forensics and Dependency Cooldown as a Structural Control

Datadog shows exactly how to read npm registry API metadata to spot the account takeover fingerprint, specifically the missing trustedPublisher field and changed maintainer email. The dependency cooldown recommendation is the most actionable structural control in any write-up so far: skipping newly published versions by default gives the community time to flag bad releases before they hit your builds.

News

Qualys Publishes Detection IDs for Axios RAT and Attributes Campaign to North Korean UNC1069

Qualys drops two QIDs (386943 and 5010006) so you can scan affected assets without building custom queries, and attributes the campaign to UNC1069, a North Korea-nexus actor using an updated WAVESHAPER implant. The GTIG attribution is the most specific yet and changes the threat model for organizations running Axios in production pipelines.

Sonatype Maps OpenClaw Package Propagation Beyond Axios to Five Additional npm Packages

Sonatype identifies five OpenClaw-linked packages that picked up the same malicious plain-crypto-js dependency, showing the blast radius extends well past the axios namespace. The 4-minute detection-to-block window Sonatype achieved is the benchmark organizations should pressure their repository firewall vendors to meet.