UNC1069 Social Engineering - Axios Maintainer Compromised
Basically, hackers tricked a software maintainer to gain access and spread malicious code.
A targeted social engineering attack by North Korean hackers compromised the Axios npm package maintainer. This incident highlights the growing risk to open-source software. Users should stay vigilant against such sophisticated threats.
What Happened
The maintainer of the popular Axios npm package, Jason Saayman, confirmed that a supply chain attack occurred due to a highly-targeted social engineering campaign by North Korean threat actors known as UNC1069. This attack was meticulously crafted to deceive Saayman, who noted that the attackers posed as the founder of a legitimate company.
How It Worked
The attackers created a convincing Slack workspace branded to look like the legitimate company's environment. They scheduled a meeting on Microsoft Teams, where they presented a fake error message claiming that something on Saayman's system was out of date. This prompted him to trigger an update, which deployed a remote access trojan (RAT) onto his system.
Who's Being Targeted
This incident highlights a worrying trend where open-source software (OSS) maintainers are becoming prime targets for sophisticated attacks. Historically, UNC1069 has focused on high-profile individuals in the cryptocurrency space, but this shift towards targeting OSS maintainers raises alarms about the security of widely-used software packages.
Signs of Infection
The immediate sign of infection was the unauthorized publication of two trojanized versions of the Axios package (1.14.1 and 0.30.4), which contained a malicious implant named WAVESHAPER.V2. Users downloading these versions were unknowingly exposing their systems to potential threats.
Business Impact
Given that Axios garners nearly 100 million weekly downloads, the potential impact of this attack is massive. Such compromises can propagate quickly through direct and transitive dependencies, affecting countless applications that rely on Axios.
What You Should Do
In response to this incident, Saayman has implemented several preventive measures:
- Resetting all devices and credentials.
- Setting up immutable releases to prevent unauthorized changes.
- Adopting OIDC flow for publishing to enhance security.
- Updating GitHub Actions to follow best practices.
These steps are crucial for maintaining the integrity of open-source projects and protecting users from malicious actors. The incident serves as a stark reminder of the vulnerabilities present in the modern software supply chain and the need for robust security measures.