Loading threat actor…
MIDNIGHT NEPTUNE, formerly tracked as UNC1069, is a North Korea-linked threat actor associated with software supply-chain compromise operations. The actor has been publicly tied to the compromise of the Axios package and is associated with tradecraft centered on poisoning trusted developer ecosystems and abusing package-management workflows to achieve initial access on downstream systems. Observed activity linked to this actor includes malicious dependency insertion and typosquatting in software repositories, with execution triggered during normal build processes rather than through direct user execution of application code. This tradecraft enables compromise during package resolution, build, check, or test operations and is consistent with stealthy supply-chain intrusion patterns. Related malware behavior reported in overlapping campaigns includes staged payload delivery, remote command execution, persistence across major desktop operating systems, downloading and launching additional scripts or payloads, and theft of browser-stored credentials. The actor’s operations emphasize defense evasion and post-compromise flexibility, including use of build scripts and trusted development tooling as execution vectors. MIDNIGHT NEPTUNE is assessed to operate in support of North Korean cyber objectives. Based on the available facts, the actor is best characterized as an espionage-oriented supply-chain threat actor with credential-theft and post-exploitation capabilities.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as attribution for a separate axios package compromise, not as the attributed actor for the crates.io incident.
Referenced in connection with supply chain compromise mitigation guidance.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.