The Forensics Way

Front Page

Nation-State Supply Chain

Axios Poisoned: North Korea's UNC1069 Targeted 183 Million Weekly Downloads in a Three-Hour Window

On March 31, North Korea-linked UNC1069 compromised the npm credentials of Axios maintainer Jason Saayman via targeted social engineering and published two backdoored versions of the most popular JavaScript HTTP client — 1.14.1 and 0.30.4 — with a combined reach of an estimated 183 million weekly downloads across the entire ecosystem.

The malicious packages installed SILKBELL, an obfuscated dropper that self-deletes after execution and replaces itself with a clean decoy that passes npm audit. Investigators must check package-lock.json files for plain-crypto-js as a dependency and hunt CI/CD build logs for unexpected outbound connections during install phases.

Cloud Forensics

Trust the Scanner, Lose 92 GB: The Trivy Breach That Hit 29 European Union Entities

When the European Commission's automated security pipeline pulled a compromised Trivy update on March 19, it unknowingly harvested an embedded AWS API key — giving attackers five days of undetected access before CERT-EU detected abnormal activity. By March 28, 92 GB of data from 29 EU entities appeared on the ShinyHunters dark web site.

CERT-EU's April 3 attribution report traced a complete forensic chain: poisoned Trivy update → stolen AWS API key → five-day undetected exfiltration. Any organization running Trivy in CI/CD pipelines during March 19–27 should treat cloud credentials as compromised and conduct a full retrospective review of API activity during that window.

Threat Bulletin

ACTIVE EXPLOIT
CVE-2026-35616

Fortinet FortiClient EMS v7.4.5–7.4.6 — Unauthenticated API bypass allows arbitrary code execution on the EMS host; CVSS 9.1. Added to CISA KEV April 6; federal deadline April 9. Forensic Note: EMS controls enterprise endpoint policy — review API call patterns and scheduled tasks on the EMS host for unauthorized lateral movement.

HIGH
CVE-2026-3502

TrueConf Client — Update mechanism lacks integrity verification, allowing server-side arbitrary executable delivery to all connected endpoints; CVSS 7.8. Exploited against Southeast Asian government networks; CISA KEV April 2. Forensic Note: Compare binary hashes to known-good versions; hunt processes spawned from the TrueConf update service.

Malware Spotlight

WAVESHAPER.V2 (UNC1069)

North Korea's cross-platform backdoor — PowerShell on Windows, Mach-O on macOS, Python on Linux — delivered via the poisoned Axios npm package, beaconing every 60 seconds. Its dropper SILKBELL self-destructs post-execution, defeating npm audit. Forensic Note: Hunt via package-lock.json diffs for plain-crypto-js and outbound C2 connections in CI/CD build logs.

4,000 Infected iOS Apps: When China Poisoned the Developer Toolchain Itself

In 2015, Chinese attackers distributed a counterfeit version of Apple's Xcode through domestic file-sharing sites, causing thousands of iOS developers to unknowingly compile malware into their own apps. Over 4,000 infected apps — including WeChat — passed Apple's code-signing process and reached end users worldwide. The case proved developer toolchain compromise is more dangerous than direct payload delivery — the developer becomes an unwitting distributor at scale.

Ownership Transfer as an Attack Vector: The npm Compromise That Foreshadowed This Week

In November 2018, a malicious contributor convinced the maintainer of event-stream — 2 million weekly downloads — to transfer package ownership, then quietly added a dependency containing a cryptocurrency stealer targeting Copay Bitcoin wallet users. The package sat undetected for two months. The case first demonstrated that npm ownership transfer itself was an attack vector, directly foreshadowing UNC1069's social engineering of the Axios maintainer this week.

The First State Cyber Espionage Campaign — Russia's Multi-Year Infiltration of US Military Networks

From 1996 to 1999, Russian state actors systematically exfiltrated terabytes from US military, NASA, and DoE networks in what became the first publicly attributed state-sponsored cyber espionage campaign — Moonlight Maze. Investigators traced the attack through telephone records and sustained international cooperation, establishing the attribution framework still applied in state-nexus cases today.

The Mandiant Report That Named Names: China's PLA Stole Terabytes From 141 US Organizations

In February 2013, Mandiant publicly attributed years of systematic IP theft to China's PLA Unit 61398 — designating them APT1. The Comment Crew maintained persistent access to 141 US organizations across 20 industries for an average of 356 days per victim, stealing terabytes of intellectual property. The report pioneered the modern threat-actor attribution methodology that every state-nexus investigation now follows.

Nation-State Supply Chain

Axios Poisoned: North Korea's UNC1069 Targeted 183 Million Weekly Downloads in a Three-Hour Window

Cloud Forensics

Trust the Scanner, Lose 92 GB: The Trivy Breach That Hit 29 European Union Entities

Threat Bulletin

Malware Spotlight

The Forensics Way

XcodeGhost (2015)

4,000 Infected iOS Apps: When China Poisoned the Developer Toolchain Itself

Event-Stream npm Poisoning (2018)

Ownership Transfer as an Attack Vector: The npm Compromise That Foreshadowed This Week

Moonlight Maze (1996–1999)

The First State Cyber Espionage Campaign — Russia's Multi-Year Infiltration of US Military Networks

Operation APT1 / Comment Crew (2006–2013)

The Mandiant Report That Named Names: China's PLA Stole Terabytes From 141 US Organizations

Velociraptor

DFIR-IRIS

Axios-SCA-2026 Scripts

StepSecurity Harden-Runner