Axios Supply Chain: Microsoft Attribution to Sapphire Sleet, RAT Persistence Mechanics, and the Dependency Cooldown Fix You Should Ship Today

Threat Intelligence

Microsoft Attributes Axios npm RAT to North Korean Sapphire Sleet via Hostwinds C2 Infrastructure

Microsoft Threat Intelligence formally attributes the Axios supply chain attack to Sapphire Sleet, a DPRK actor known for targeting crypto and finance. The C2 IP ties directly to Hostwinds VPS infrastructure that Sapphire Sleet is documented to reuse, which is a concrete pivot point for threat hunters.

Google GTIG Assigns Axios RAT Activity to UNC1069 Based on WAVESHAPER.V2 Overlap

Qualys surfaces the Google Threat Intelligence Group's independent attribution linking the macOS Mach-O payload to WAVESHAPER.V2, an updated backdoor variant previously tracked to UNC1069, which overlaps with Sapphire Sleet. Two independent research teams converging on the same North Korean cluster from different payload artifacts is about as confident as attribution gets.

Analysis

Datadog: How npm Registry Metadata Exposed the Axios Account Takeover in Real Time

Datadog walks through exactly how the maintainer email swap from jasonsaayman@gmail.com to ifstap@proton.me and the missing OIDC trusted publisher field in version metadata are forensic signals visible in the public registry API. This is a repeatable detection pattern any team can operationalize for monitoring their own dependency chains.

Malware Analysis

Elastic: All Three Axios RAT Variants Share Identical C2 Protocol, IE8 User-Agent, and Command Set

Elastic confirms the Windows, macOS, and Linux payloads are three implementations of a single RAT spec, same beacon interval, same JSON message format, same anachronistic IE8 user-agent hardcoded across all platforms. That IE8 string on a Linux or macOS host is a trivial but reliable detection signal that defenders should be hunting for right now.

Incident Response

Bitdefender: Windows Persistence via MicrosoftUpdate Run Key Survives Reboots and the Kill Command

Bitdefender details how the Windows RAT writes system.bat to %PROGRAMDATA% and registers it under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate, meaning a reboot does not clear the threat and the RAT's own kill command leaves this persistence intact. Any Windows system in the exposure window needs the registry key and batch file explicitly hunted and removed, not just a process kill.