For three hours on a Tuesday morning, the keys to a software developer's account were held by people believed to work for North Korea, and through that narrow opening they reached into the machinery of countless American businesses. Axios, a quiet tool for building and managing websites, now carries a shadow it did not ask for, because the danger lies upstream, where nobody thinks to look until an update has already arrived. It is one more chapter in a long story in which a nation with little else to trade turns the trust built into shared software into a source of funds for its weapons, and t
North Korean Hackers Compromise Axios Software Used by Thousands of US Firms in Crypto Heist Push
Three hours of access, and months of cleanup ahead
Mark
Three hours doesn't sound like very long. Why does it matter so much?
Mimi
Because Axios sits underneath other people's websites. Anyone who downloaded it in that window got the malicious update, and companies across health care and finance use it.
Mark
So how many victims are there?
Luke
Confirmed, not many. Huntress has found about 135 devices at roughly 12 companies. That's one firm's snapshot, not a total.
Mimi
And Hammond expects the number to climb as organizations find out they were hit.
Mark
Who is behind it?
Luke
Mandiant says a suspected North Korean group. That's an attribution from a security firm, and the word suspected is doing real work there.
Mark
What do they want?
Mimi
Money. Carmakal expects them to use the stolen credentials and access to go after crypto at enterprises. North Korea's hacking has funded its weapons programs, and a White House official said in 2023 that about half the missile program was paid for that way.
Luke
Worth noting that the crypto targeting is an expectation, not something reported as already happening from this breach.
Mark
And the AI angle?
Luke
That's Hammond's view that AI agents writing code without review made this timing ideal. It's an opinion from one researcher, not a finding about how this attack worked.
Mimi
What's firm is the timeline. Months to assess the damage, by Mandiant's estimate.
El Pulso
- For three hours, suspected North Korean hackers controlled a developer's account and pushed malicious Axios updates to anyone who downloaded them.
- Because Axios runs quietly inside health care, finance and crypto firms, no one can yet say how far the contamination has spread.
- Cybersecurity teams are racing to trace roughly 135 compromised devices at 12 companies, a count everyone expects to climb.
- Mandiant warns the stolen access will likely be turned toward cryptocurrency theft, and the damage may take months to fully measure.
For three hours on a Tuesday morning, the keys to a software developer's account were held by people believed to work for North Korea, and through that narrow opening they reached into the machinery of countless American businesses. Axios, a quiet tool for building and managing websites, now carries a shadow it did not ask for, because the danger lies upstream, where nobody thinks to look until an update has already arrived. It is one more chapter in a long story in which a nation with little else to trade turns the trust built into shared software into a source of funds for its weapons, and the full accounting of who was touched will take months to write.
For three hours on Tuesday morning, suspected North Korean hackers held the keys to the account of a developer who maintains Axios, an open-source package that thousands of US companies rely on. In that window, every organization that downloaded the software received malicious updates. The developer fought to reclaim his account while cybersecurity executives across the country began the difficult work of estimating the damage.
Axios helps build and manage websites, and it is woven into nearly every sector, from health care to finance and crypto. That breadth makes this kind of supply-chain attack hard to measure. The compromise sits upstream, and its victims are simply whoever happened to pull the update.
Mandiant, the Google-owned cyber-intelligence firm, attributed the attack to a suspected North Korean group and expects them to use their new access to steal cryptocurrency from enterprises. The confirmed count is still small: researchers at Huntress have found about 135 compromised devices belonging to roughly 12 companies, and they describe that as only a snapshot.
The motive is money. Pyongyang's hackers have reportedly stolen billions from banks and crypto firms, funding a sanctioned nuclear state's programs. Experts say the regime accepts the noise and exposure of operations like this as a cost of doing business. What to watch now is how the stolen access is used and how many more victims come forward.
For three hours on Tuesday morning, suspected North Korean hackers held the keys to the account of a software developer who maintains Axios, an open-source package that thousands of US companies rely on. In that window, they used the access to push malicious updates to any organization that downloaded the software. The developer scrambled to take back his account, and cybersecurity executives across the country began working out how much damage had been done.
Axios is a tool for building and managing websites, and its reach is broad. Companies in nearly every sector use it, from health care to finance. Some cryptocurrency firms use it, as do technology companies active in the crypto industry. That breadth is what makes a supply-chain attack of this kind so hard to size: the compromise sits upstream, and the victims are whoever happened to pull the update.
Mandiant, the cyber-intelligence firm owned by Google, attributed the attack to a suspected North Korean hacking group. Charles Carmakal, the firm's chief technology officer, told CNN that Mandiant expects the group to try to use the credentials and system access it just obtained to target and steal cryptocurrency from enterprises. He said it will likely take months to assess the downstream impact of the campaign.
The count of confirmed victims is still small. John Hammond, a security researcher at Huntress, said his firm has identified about 135 compromised devices belonging to roughly 12 companies. He described that as only a snapshot, and the pool of victims is expected to grow as organizations discover they were hit.
This is not the first time Pyongyang has been tied to an attack of this type. Three years ago, North Korean operatives allegedly infiltrated another popular software provider, one whose voice and video calling product was used by healthcare firms and hotel chains.
The motive is financial. North Korea's hacking corps is an essential source of revenue for a nuclear-armed country battered by sanctions. According to reports from the United Nations and private firms, its hackers have stolen billions of dollars from banks and cryptocurrency companies over the last several years. A White House official said in 2023 that about half of the country's missile program had been funded by such digital heists. Last year, North Korean hackers took $1.5 billion in cryptocurrency in a single attack, then the largest crypto hack on record.
Ben Read, director of strategic threat intelligence at Wiz, another Google-owned security firm, said North Korea is not worried about its reputation or about eventually being identified. Operations like this one are noisy and high profile, he said, but that is a price the country is willing to pay.
Hammond called the timing "perfect," pointing to the spread of AI agents that write software at organizations "without any review or guardrails." The software supply chain's greatest weakness, he said, has an open door at a time when too many people no longer read what goes into the ingredients.
What to watch now is the crypto side. Mandiant expects stolen access to be turned toward cryptocurrency theft, and the list of affected companies will likely lengthen as investigations continue.
Citas Notables
We anticipate they will try to leverage the credentials and system access they recently obtained to target and steal cryptocurrency from enterprises.— Charles Carmakal, CTO, Mandiant
North Korea isn't worried about its reputation or being eventually identified, so noisy, high-profile operations are a price they're willing to pay.— Ben Read, director of strategic threat intelligence, Wiz (paraphrased)
Quieres la nota completa?
Lee el original en Cable News Network ↗
Technology