Overview
Google reported on Tuesday that cyber actors tied to North Korea compromised an update to Axios, a little-seen but widely used piece of open-source software that facilitates communication between applications and web services. Security researchers who analyzed the incident said the attackers added their own malicious program to an Axios update issued on Monday, enabling the code to run in environments that load the library.
How the intrusion worked
According to researchers, the injected malware was designed to collect data from infected machines, including login credentials. That information can be leveraged to conduct further intrusions, data theft, or other operations. The malicious code has been removed from the compromised update, researchers said.
Tom Hegel, a senior researcher at SentinelOne, emphasized Axios' pervasiveness: "Every time you load a website, check your bank balance, or open an app on your phone, there’s a good chance Axios is running somewhere in the background making that work." Hegel warned that because the software is trusted and runs automatically in many contexts, users do not need to click anything or take any other action for an infection to occur.
Attribution and motive
Google attributed the hack to a group it monitors as UNC1069. In a February report cited by Google, the group has been active since at least 2018 and has targeted the cryptocurrency and financial sectors. John Hultquist, chief analyst for Google's threat intelligence group, said: "North Korean hackers have deep experience with supply chain attacks, which they primarily use to steal cryptocurrency."
The article notes that stolen cryptocurrency is used by North Korea to fund weapons and other programs and to evade sanctions, according to the U.S. government. North Korea’s mission to the U.N. did not immediately respond to a request for comment.
Scope and technical details
Security firm Elastic Security published an analysis showing the attackers prepared versions of the malware that could run on macOS, Windows and Linux. Elastic said the attackers' approach "gained a delivery mechanism with potential reach into millions of environments." It was not clear how many times the malicious update was downloaded.
The developers of Axios could not immediately be reached for comment. Efforts to contact the hackers were unsuccessful.
Summary note - The breach is being treated as a supply-chain attack: compromises at the software source that can enable downstream intrusions into organizations and devices that consume the affected code.