Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Inside the Axios supply chain compromise - one RAT to rule them all
Threat Actors
Excerpt
Elastic Security Labs released initial triage and detection rules for the Axios supply-chain compromise. This is a detailed analysis of the RAT and payloads. Introduction Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | Medium | Score 53/100 | First seen |
| Domain | sfrclak.com | High | Score 86/100 | First seen |
| URL | http://sfrclak.com:8000/6202033 | High | Score 66/100 | First seen |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | High | Score 82/100 | First seen |
| IP | 142.11.206.73 | High | Score 74/100 | First seen |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…