FrostArmada Disrupted, Axios Fallout Continues, and APT28 Goes After M365

News

FBI and International Partners Dismantle APT28's FrostArmada Router Hijack Campaign

APT28 compromised 18,000 SOHO routers across 120 countries to silently redirect DNS and steal Microsoft 365 credentials and OAuth tokens via adversary-in-the-middle proxies. The FBI's court-authorized operation pushed DNS resets to affected routers, but if you run MikroTik or TP-Link gear on a network with sensitive accounts, check your DNS resolver settings and patch or replace EOL hardware now.

Analysis

Microsoft Attributes Axios npm RAT to North Korean Sapphire Sleet

Microsoft Threat Intelligence formally attributed the axios supply chain attack to Sapphire Sleet, a North Korean state actor known for targeting crypto and finance orgs. The blog details the full kill chain including the phantom dependency trick, platform-specific RAT payloads, and C2 infrastructure tied to Hostwinds VPS nodes Sapphire Sleet routinely uses.

Orca Security: Full Technical Teardown of the Axios Supply Chain Attack

Orca's writeup is the most complete technical breakdown of the attack, covering the two-layer XOR obfuscation in setup.js, the anti-forensic package.json swap, and the per-OS RAT behavior including the Linux payload orphaning itself to PID 1 to evade process-tree detection. Good reference doc to share with your security team for detection rule building.

Phoenix Security: Axios RAT Credential Harvesting Scope Is Broader Than Reported

Phoenix Security's analysis highlights that the Windows RAT used reflective .NET assembly injection to stay off disk and swept a wide credential inventory including Kubernetes tokens, Terraform state files, crypto wallets, and shell history. If your CI pipeline ran npm install during the 3-hour window, treat every secret on that runner as compromised.

Emergence AI CISO: Eight Controls That Would Have Blocked the Axios Attack

A practical breakdown from a practitioner perspective covering exact version pinning, frozen lockfile CI installs, postinstall script disabling, and OIDC workload identity as the specific controls that would have stopped this attack at multiple stages. Worth using as a checklist against your own pipeline hardening.