North Korean Supply Chain Playbook: Sapphire Sleet, Axios RAT Mechanics, and What Defenders Missed

Analysis

Microsoft Attributes Axios npm RAT to Sapphire Sleet, Details CI/CD Exposure and Mitigation Steps

Microsoft Threat Intelligence formally pins this campaign on Sapphire Sleet, a North Korean state actor targeting crypto and finance. The blog is the most complete technical writeup available, covering the full kill chain from dependency injection to OS-specific RAT delivery and persistence.

Datadog: Axios Attacker Bypassed 2FA, OIDC Metadata Fingerprinted the Takeover in Real Time

Datadog's registry forensics show exactly how the attacker bypassed 2FA using a likely stolen recovery code and how the missing trustedPublisher field in npm metadata was the clearest early signal of compromise. The Linux and Windows payload bugs they found mean real-world impact was narrower than the attack's reach suggested.

Sonatype: Axios Compromise Spread Beyond the Core Package Into OpenClaw Dependencies

Sonatype flagged the malicious packages within 43 minutes and found the same plain-crypto-js payload propagating into OpenClaw-related packages, showing the blast radius extended beyond axios itself. This is the clearest evidence yet that the attacker planned for downstream spread, not just a single-package hit.

News

SANS: Axios npm Compromise IR Checklist, RAT Artifact Locations, and the TeamPCP IAB Theory

SANS lays out a practical incident response checklist with exact file paths for RAT artifacts across macOS, Windows, and Linux, plus the package hashes you need for detection. The TeamPCP initial access broker theory is worth tracking if you think this is an isolated incident.

Qualys: Google's GTIG Assigns Axios RAT to UNC1069, Links Payload to WAVESHAPER.V2

Qualys adds a second attribution track: Google Threat Intelligence Group ties this to UNC1069 via the WAVESHAPER.V2 RAT variant, giving defenders two independent threat actor profiles to cross-reference. QIDs 386943 and 5010006 are live for scanning.