UNC6426Threat actor
UNC6426 exploited a supply chain compromise of the nx npm package to steal a developer's GitHub Personal Access Token and gain access to a victim's cloud environment. They abused the GitHub-to-AWS OpenID Connect trust to create a new administrator role, leveraging overly permissive permissions associated with the compromised GitHub-Actions-CloudFormation role.From MISP Galaxy
Last reported 26 days ago, by Qualys Threat Research1 report
ATT&CK techniques
6 of 20 · each with the sentence it comes from- T1036.005Match Legitimate Resource Name or Location
“T1036.005 Match Legitimate Resource Name or Location Typosquatting, e.g.”
- T1059Command and Scripting Interpreter
“T1059.004 Command and Scripting Interpreter: Unix Shell Shell scripts and Bun-based payloads executing in CI runners”
- T1059.004Unix Shell
“T1059.004 Command and Scripting Interpreter: Unix Shell Shell scripts and Bun-based payloads executing in CI runners”
- T1078.004Cloud Accounts
“T1078.004 Valid Accounts: Cloud Accounts Stolen AWS/Azure/GCP credentials used for legitimate API calls”
- T1098Account Manipulation
“T1098.004 Account Manipulation: SSH Authorized Keys Appending attacker public keys to ~/.ssh/authorized_keys”
- T1098.004SSH Authorized Keys
“T1098.004 Account Manipulation: SSH Authorized Keys Appending attacker public keys to ~/.ssh/authorized_keys”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches“The European Commission incident and the UNC6426 campaign demonstrate that this is not merely a theoretical risk; compromised development environments can become a path to significant cloud impact.”
Indicators in its reports
named in the reports above- blog.gitguardian[.]comin 1 report
- hxxps://www.jsdelivr[.]com/blog/joining-forces-with-algolia-for-an-even-better-npm-search/in 1 report
- www.jsdelivr[.]comin 1 report
- hxxps://blog.gitguardian[.]com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/in 1 report
- hxxps://arcticwolf[.]com/resources/blog/wormable-malware-causing-supply-chain-compromise-of-npm-code-packages/in 1 report
- arcticwolf[.]comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.