Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff
Excerpt
Key Facts A supply chain attack affecting the NPM (Node Package Manager) package “Axios” (widely used JavaScript HTTP-Client) was made public in end March 2026. DCSO’s analysis of the published indicators and email addresses suggests connections to the DRPK linked threat actor “BlueNoroff”, based on overlaps between activities historically attributed to BlueNoroff and the infrastructure identified in this case. DCSO did observe overlaps in the threat actor’s techniques and…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 23.254.167.216 | High | Score 64/100 | First seen |
| URL | http://sfrclak.com:8000/6202033 | High | Score 66/100 | First seen |
| URL | http://sfrclak.com | High | Score 58/100 | First seen |
| IP | 142.11.206.73 | High | Score 74/100 | First seen |
| IP | 23.254.203.244 | High | Score 64/100 | First seen |
| URL | http://sfrclak.com:8000 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…