UNC6426
UNC6426 is a threat actor tracked by Google that conducted a follow-on intrusion using credentials stolen during the August 2025 supply-chain compromise of the nx npm package. Google documented the activity in its Cloud Threat Horizons Report for H1 2026. The actor used stolen GitHub tokens, including a developer GitHub token, to breach a victim AWS environment within 72 hours. Reported activity included reconnaissance in the victim’s GitHub environment, abuse of a GitHub-to-AWS OpenID Connect trust relationship, generation of AWS STS tokens, deployment of a CloudFormation stack, creation of a new IAM role with AdministratorAccess, exfiltration of files from AWS S3 buckets, and destructive actions in production cloud environments, including termination of production EC2 and RDS resources. The reporting also states that UNC6426 used the open-source tool Nord Stream to extract CI/CD secrets and that, in the final stage of the intrusion, internal GitHub repositories were renamed to s1ngularity-repository variants and made public. UNC6426 is directly associated in the provided content with exploitation of credentials stolen from the nx compromise; no additional aliases or nation-state attribution are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Follow-on operation that leveraged stolen GitHub tokens from the NX compromise to breach a victim AWS environment rapidly.
Leveraged credentials stolen via the trojanized nx npm package supply-chain compromise to pivot from GitHub into AWS by abusing GitHub-to-AWS OIDC trust, creating new IAM administrator roles, exfiltrating S3 data, and performing destructive actions (terminating EC2/RDS, renaming and publishing internal GitHub repos).
Exploited access obtained from the nx npm supply-chain compromise to steal a developer's GitHub token, abuse GitHub-to-AWS OIDC trust, create a new AWS administrator role, exfiltrate data from S3 buckets, and perform destructive actions in the victim's production cloud environment.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.