North Korean Hackers Compromise Widely Used Axios Software in Supply-Chain Attack Aimed at Crypto Theft

For three hours on Tuesday morning, someone else held the keys to a software developer's account. The developer maintains Axios, an open-source package that thousands of US companies use to build and manage their websites. In that window, the people behind the intrusion pushed out malicious updates to any organization that downloaded the software. Security experts told CNN the people responsible are suspected North Korean hackers.

The developer scrambled to regain control of the account, while cybersecurity executives across the country began working out how much damage had been done. Axios is used in just about every sector of the economy, from health care to finance. Some cryptocurrency firms rely on it, as do technology companies active in the crypto industry.

Mandiant, the cyber-intelligence firm owned by Google, attributed the attack to a suspected North Korean hacking group. Charles Carmakal, the firm's chief technology officer, said Mandiant expects the group to try to use the credentials and system access it just obtained to target and steal cryptocurrency from enterprises. He said it will likely take months to assess the downstream impact of the campaign.

The count of victims is still small and still moving. John Hammond, a security researcher at Huntress, said his firm has identified about 135 compromised devices belonging to roughly 12 companies. He described that as a narrow snapshot, with the number of victims expected to surge as organizations discover they were hit.

The experts responding to the incident told CNN they expect a long-term campaign to steal cryptocurrency to fund the North Korean regime. Pyongyang often spends such money on its nuclear and missile programs. Its hacking corps is an essential source of revenue for a nuclear-armed country battered by sanctions, and reports from the United Nations and private firms say North Korean hackers have stolen billions of dollars from banks and crypto firms in recent years. A White House official said in 2023 that about half of the country's missile program had been funded by digital heists. Last year, North Korean hackers stole $1.5 billion in cryptocurrency in a single attack, then the largest crypto hack on record.

This is not the first sweeping supply-chain attack attributed to Pyongyang. Three years ago, North Korean operatives allegedly infiltrated another popular software provider, one whose voice and video calling tools were used by healthcare firms and hotel chains.

Ben Read, director of strategic threat intelligence at Wiz, another Google-owned security firm, said North Korea is not worried about its reputation or about eventually being identified. Operations like this one are noisy and high profile, he said, but that is a price the country is willing to pay.

Hammond called the hack perfectly timed, pointing to the growing use of AI agents that develop software inside organizations without any review or guardrails. In his words, the biggest weakness in the whole software supply chain has an open door in an era when too many people no longer read what goes into the ingredients.

What to watch now is the victim count from firms like Huntress as organizations check their systems, and whether the stolen access turns into thefts from crypto-linked companies, as Mandiant expects.