Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Amazon identifies North Korean hacker group behind open-source supply chain attacks
Threat Actors
Excerpt
Amazon is sharing new findings about how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries, the shared building blocks that companies around the world use to develop applications. Amazon Threat Intelligence has linked several recent compromises of popular Node Package Manager (NPM) libraries to the same DPRK-linked threat actor, a connection that hasn’t been publicly reported until now. The analysis also…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 216.74.123.126 | High | Score 58/100 | First seen |
| SHA1 | 22d200f8670dbdb3e253a90eee5098477c95c23d | High | Score 82/100 | First seen |
| SHA256 | 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f | Medium | Score 53/100 | First seen |
| Domain | npmjs.store | High | Score 58/100 | First seen |
| SHA256 | 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…