Axios Supply Chain Postmortem: SANS IR Checklist, Qualys Detection QIDs, and the Social Engineering Play That Started It All

Analysis

SANS Axios IR Checklist: Artifacts, Credential Rotation, and CI/CD Scope

SANS breaks down exactly what to look for on each platform and why CI/CD runners are in scope, not just dev workstations. The credential rotation guidance is the most actionable quick-reference if you are scoping an incident right now.

Datadog: How the Axios Maintainer Account Takeover Shows Up in npm Registry Metadata

Datadog's forensic angle is the most useful here: the publisher email swap and missing trustedPublisher field in registry metadata are concrete, scriptable signals you can check before running any code. They also document the Windows and Linux payload bugs that limited attacker effectiveness during the live window.

Threat Intelligence

Microsoft Attributes Axios RAT to Sapphire Sleet, Details OS-Specific Payload Chain

Microsoft's writeup adds the North Korean attribution and documents the single-endpoint C2 design where one route serves macOS, Windows, and Linux payloads via POST body switching. The exact npm config hardening steps to disable auto-updates are worth bookmarking for every project that pins dependencies loosely.

Malware Analysis

Elastic: Three Platform-Native RAT Implementations, One Shared C2 Protocol

Elastic's teardown confirms all three stage-2 payloads share identical C2 protocol, command set, and the anachronistic IE8/Windows XP user-agent string that is a trivial network detection signal. The capability table comparing persistence, script execution, and binary injection across Windows, macOS, and Linux is the fastest way to understand attacker reach by platform.

Detection

Qualys Issues QIDs 386943 and 5010006 for Axios Compromise Detection

If you run Qualys, these are the two QIDs to run now. The post also confirms Google Threat Intelligence Group assigned this to UNC1069 and WAVESHAPER.V2, adding a second independent attribution track alongside Microsoft's Sapphire Sleet label.