Hackers linked to North Korea infiltrated Axios, a software program that underpins many common online functions, in what Google and independent researchers describe as a supply chain attack, according to Reuters. The breach involved embedding malicious software in an Axios update issued Monday, potentially giving attackers access to login credentials and sensitive data without users taking any action. Tom Hegel, senior researcher at SentinelOne, explained that Axios runs in the background for countless websites, banking apps, and other online services, meaning the hack could reach millions of computers worldwide.
Google attributed the attack to a group it tracks as UNC1069, active since at least 2018 and known for targeting the cryptocurrency and financial sectors. John Hultquist, chief analyst for Google’s threat intelligence team, noted that North Korean hackers frequently use supply chain attacks to steal cryptocurrency, which is then used to fund weapons programs and bypass international sanctions. The malware affected macOS, Windows, and Linux systems, giving hackers a delivery mechanism capable of infiltrating an extensive range of environments, according to Elastic Security.
Because Axios is open-source software, its code can be freely modified and distributed, which allowed attackers to embed their malicious version into an official update. Cybersecurity experts warn that supply chain attacks are particularly dangerous because trusted software essentially performs the compromise for the user, eliminating the need for victims to click on malicious links or make errors themselves.
The full extent of the attack remains unclear, including how many times the infected software was downloaded or which downstream organizations may have been affected. Attempts to reach Axios developers and the North Korean mission to the United Nations for comment were unsuccessful.
