TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Palo Alto Unit 42

Threat Brief: Widespread Impact of the Axios Supply Chain Attack

Unit 42 · 2026-04-01 · Read original ↗

ATT&CK techniques detected

19 predictions
T1071.001Web Protocols
98%
“with advanced threat prevention next - generation firewall with the advanced threat prevention security subscription can help block the attack via the following threat prevention signature : 87121. cloud - delivered security services for the next - generation firewall advanced ur…”
T1195.001Compromise Software Dependencies and Development Tools
98%
“. cortex xdr customers can also use these xql queries to search for signs of exploitation. conclusion attackers have been increasing the frequency and scale of npm supply chain operations since early 2026. securing the continuous integration / continuous deployment ( ci / cd ) pi…”
T1195.001Compromise Software Dependencies and Development Tools
97%
“, to validate that your builds are not automatically pulling the poisoned “ latest ” versions. - disable lifecycle scripts : use the - - ignore - scripts flag during ci / cd installations to explicitly prevent npm postinstall hooks from running during automated builds. long - ter…”
T1195.001Compromise Software Dependencies and Development Tools
97%
“threat brief : widespread impact of the axios supply chain attack executive summary unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the axios javascript library. the attack occurred after an axios maintainer ' s npm account w…”
T1195.001Compromise Software Dependencies and Development Tools
94%
“discover the malicious packages or rat artifacts, immediately isolate the system from the network. remediation and rebuilding - rebuild from scratch : if an environment is compromised, do not attempt to clean the malware while it is still in place. instead, completely rebuild the…”
T1071.001Web Protocols
90%
“. unified rat architecture despite being written in three different languages ( c + +, powershell and python ), all three payloads function as implementations of the same rat framework. they all use an identical c2 protocol, send base64 - encoded json data over an http post reque…”
T1195.001Compromise Software Dependencies and Development Tools
87%
“people ’ s republic of korea ( dprk ). this campaign has affected the following sectors in the u. s., europe, middle east, south asia and australia : - business services - customer service - financial services - high tech - higher education - insurance - media and entertainment -…”
T1195.001Compromise Software Dependencies and Development Tools
81%
“: pin axios to these safe versions within your package - lock. json file to prevent accidental upgrades. - use overrides : add an overrides block in your package configuration to prevent malicious versions from being resolved transitively by other packages. - restrict corporate r…”
T1105Ingress Tool Transfer
78%
“[. ] org / product1 for windows - packages. npm [. ] org / product2 for linux figure 1 shows the commands for this first - stage download. execution of the rat the c2 server delivers a different payload depending on the victim ' s operating system : - macos : the dropper uses app…”
T1587Develop Capabilities
73%
“. cortex xdr customers can also use these xql queries to search for signs of exploitation. conclusion attackers have been increasing the frequency and scale of npm supply chain operations since early 2026. securing the continuous integration / continuous deployment ( ci / cd ) pi…”
T1587Develop Capabilities
69%
“threat brief : widespread impact of the axios supply chain attack executive summary unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the axios javascript library. the attack occurred after an axios maintainer ' s npm account w…”
T1195.001Compromise Software Dependencies and Development Tools
58%
“the command - line arguments. the c2 server ' s address is also provided via command - line parameters, allowing the backdoor to download and execute arbitrary payloads from the adversary ' s infrastructure. waveshaper also runs as a daemon by forking itself into a child process …”
T1055.012Process Hollowing
57%
“##f608a8b9579517bc0695 - 526ab39d1f56732e4e926715aaa797feb13b1ae86882ec570a4d292e7fdc3699 - a98e04dec3a7fe507eb30c72da808bad60bc14d9d80f9770ec99c438faa85a1a - 0d83030ab8bfba675fc1661f0756b6770be7dd80b1b718de3d68a01f2e79a5f4 - 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d007…”
T1566.001Spearphishing Attachment
56%
“##12307cf583c900d101 - e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff - 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a - 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 - 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f4875…”
T1195.001Compromise Software Dependencies and Development Tools
55%
“. 1 into the package. json file as a runtime dependency. the postinstall dropper with compromised versions of axios, when a developer runs npm install axios, npm automatically resolves the dependency tree and installs plain - crypto - js. this triggers npm ' s postinstall lifecyc…”
T1195.002Compromise Software Supply Chain
53%
“threat brief : widespread impact of the axios supply chain attack executive summary unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the axios javascript library. the attack occurred after an axios maintainer ' s npm account w…”
T1566.001Spearphishing Attachment
45%
“##672c3f98f21925bd26d9a9bba036b67d84fde0dfdbe2cf9b85b170cab71 - 20df0909a3a0ef26d74ae139763a380e49f77207aa1108d4640d8b6f14cab8ca - 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22 - 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 - 4465bdeaddc8c04…”
T1587Develop Capabilities
38%
“, to validate that your builds are not automatically pulling the poisoned “ latest ” versions. - disable lifecycle scripts : use the - - ignore - scripts flag during ci / cd installations to explicitly prevent npm postinstall hooks from running during automated builds. long - ter…”
T1566.001Spearphishing Attachment
34%
“##60a9ef78e22ff7 - fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf - cdc05cd30eb53315dadb081a7b942bb876f0d252d20e8ed4d2f36be79ee691fa - 8449341ddc3f7fcc2547639e21e704400ca6a8a6841ae74e57c04445b1276a10 - 01c9484abc948daa525516464785009d1e7a63ffd6012b9e85b56477acc3…”

Summary

Unit 42 discusses the supply chain attack targeting Axios. Learn about the full attack chain, from the dropper to forensic cleanup.

The post Threat Brief: Widespread Impact of the Axios Supply Chain Attack appeared first on Unit 42.