Sapphire Sleet / UNC1069
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -145 |
| Sum | -80 |
- The page establishes that the subject is itself a scheme, so the score is 0.
- 2 sections set aside: the claims did not hold up in a fact-check, pending correction.
Score: 0/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-02 · 4 of 8 claims confirmed · 3 need better sources · 1 disputed
anchored·2egUDH…o8BRSummary
Sapphire Sleet (Microsoft designation) / UNC1069 (Google Mandiant designation) is a North Korean state-sponsored advanced persistent threat group assessed to operate under the Reconnaissance General Bureau, active since at least 2018. The group is financially motivated and primarily targets cryptocurrency exchanges, DeFi platforms, venture capital funds, wallet providers, and software developers. On March 31, 2026, the group executed a supply chain compromise of the axios npm package — which receives over 100 million weekly downloads — deploying the WAVESHAPER.V2 cross-platform remote access trojan to approximately 600,000 installations during a three-hour exposure window.
Connected Entities
7 entities · 60 linked investigations- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Solana(65%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift(85%)
- Sapphire Sleet / UNC1069→mentioned with→Mach-O Man Malware Campaign (Lazarus / Chollima)(60%)
- Citrine Sleet / AppleJeus→mentioned with→Drift Protocol(80%)
- Axios npm Supply Chain Attack (March 2026)→mentioned with→Sapphire Sleet / UNC1069(80%)
- Drift Protocol→mentioned with→Citrine Sleet / AppleJeus(80%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Citrine Sleet / AppleJeus(80%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift Protocol(80%)
- Sapphire Sleet / UNC1069→mentioned with→Axios npm Supply Chain Attack (March 2026)(80%)
- Sapphire Sleet / UNC1069→mentioned with→Citrine Sleet / AppleJeus(80%)
- + 8 more
Connected Through
7 shared actors · 359 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Solanaorganization
- ⌂Drift Protocolprotocol
- □Driftorganization
- □Citrine Sleet / AppleJeusorganization
Timeline(12 events)
April 2018
UNC1069 becomes active (earliest tracked date per Google Mandiant), focusing on cryptocurrency exchanges in the United States and Japan.
Tenable FAQ on UNC1069 axios attackJune 2020
ClearSky publishes CryptoCore report tracking the group's estimated $200 million minimum theft from cryptocurrency exchanges since 2018.
The Hacker News — Google Attributes Axios npm Supply Chain Attack to UNC1069March 2020
Microsoft begins tracking the threat cluster as Sapphire Sleet, identifying it as a North Korean nation-state actor targeting the cryptocurrency sector.
Microsoft Security Blog — Mitigating the Axios npm supply chain compromise22 November 2024
Microsoft presents at CYBERWARCON noting Sapphire Sleet stole over $10 million in cryptocurrency from multiple companies over a six-month window, using fake VC and recruiter social engineering lures.
Microsoft Security Blog — CYBERWARCON threat intelligenceOctober 2025
Concurrent DPRK-linked group (UNC4736 / Citrine Sleet) begins six-month social engineering operation against Drift Protocol Security Council members, posing as a quantitative trading firm at a major crypto conference.
The Hacker News — Drift $285M DPRK nonce attackFebruary 2026
Google Threat Intelligence publishes report documenting UNC1069's deployment of AI-generated deepfakes, fake Zoom and Teams meetings, ClickFix infection vectors, and a seven-family malware arsenal including WAVESHAPER, HYPERCALL, and SILENCELIFT.
The Hacker News — North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations30 March 2026
Attacker publishes clean decoy package plain-crypto-js@4.2.0 to the npm registry at 05:57 UTC. Malicious plain-crypto-js@4.2.1 published at 23:59 UTC.
Tenable FAQ on UNC1069 axios attack31 March 2026
axios@1.14.1 published at 00:21 UTC and axios@0.30.4 at approximately 01:00 UTC with WAVESHAPER.V2 payload. Socket.dev detects the compromise at 00:05 UTC (approximately 6 minutes after plain-crypto-js@4.2.1 publication). Both malicious axios versions removed from npm registry at approximately 03:15 UTC. Approximately 600,000 installations occur during the roughly 3-hour exposure window.
CISA Alert; SANS Emergency Briefing; Tenable FAQApril 2026
Microsoft publishes initial attribution blog post identifying Sapphire Sleet as the threat actor behind the axios compromise. Drift Protocol loses $285 million in a separate DPRK-linked durable nonce attack attributed to UNC4736/Citrine Sleet.
Microsoft Security Blog; The Hacker News2 April 2026
Google Mandiant confirms attribution of axios attack to UNC1069, publishing technical details and infrastructure overlaps linking the operation to prior UNC1069 WAVESHAPER deployments via AstrillVPN node.
SANS Emergency Briefing16 April 2026
Microsoft publishes a follow-on technical post dissecting Sapphire Sleet's macOS intrusion chain, covering credential theft and elevation of privilege techniques.
Microsoft Security Blog — Dissecting Sapphire Sleet's macOS intrusion20 April 2026
CISA publishes formal alert on the axios npm supply chain compromise with technical IOCs, affected version list, safe downgrade targets, and mitigation guidance.
CISA AlertDecision Log
- slot 464374965 · hash DCvT7pLMSEqwAsc47U7Kx48YSvtko1KFfWKZewkioJQs
- slot 464374960 · hash BaLA5ZPdAqxQosn4Q8zXehmnw3pmdo11cfPm2gXzrWrR
- slot 461964350 · hash DNEzrcQ1LjBDZ3BvHD13W3EBZY7AxX1B9MRFU94auDdW
- slot 427602200 · hash 3R2MZqYakLhNonkDCWpoekXkn2Stg4dhk3KjmL2MgKjP
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 15 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/19/2026, 11:05:13 PM
last updated: 11/2/2026, 5:18:19 AM
2 viewsavoid.net — verified advice for a post-truth world