Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
11 IOCs
Elastic releases detections for the Axios supply chain compromise
Malware Families
Excerpt
Elastic Security Labs is releasing an initial triage and detection rules for the Axios supply-chain compromise. We have released a detailed analysis on the Axios compromise RAT and payloads. Elastic Security Labs filed a GitHub Security Advisory to the axios repository on March 31, 2026 at 01:50 AM UTC to coordinate disclosure and ensure the maintainers and npm registry could act on the compromised versions. Introduction We are currently tracking a supply chain attack…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →11 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 | Medium | Score 53/100 | First seen |
| SHA256 | e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | High | Score 64/100 | First seen |
| SHA256 | e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff | Medium | Score 53/100 | First seen |
| Domain | sfrclak.com | High | Score 86/100 | First seen |
| URL | http://sfrclak.com:8000/6202033 | High | Score 66/100 | First seen |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | High | Score 82/100 | First seen |
| URL | http://sfrclak.com:8000/ | High | Score 58/100 | First seen |
| IP | 142.11.206.73 | High | Score 74/100 | First seen |
| SHA256 | 6483c004e207137385f480909d6edecf1b699087378aa91745ecba7c3394f9d7 | Medium | Score 53/100 | First seen |
| SHA256 | ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c | Medium | Score 53/100 | First seen |
| SHA1 | 07d889e2dadce6f3910dcbc253317d28ca61c766 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…