Skip to main content
AVOID.NET
Sign in

Sapphire Sleet / UNC1069

avoid.net/sapphire-sleet-unc1069→2/100·93% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2egUDH…o8BR

Summary

Sapphire Sleet (Microsoft designation) / UNC1069 (Google Mandiant designation) is a North Korean state-sponsored advanced persistent threat group assessed to operate under the Reconnaissance General Bureau, active since at least 2018. The group is financially motivated and primarily targets cryptocurrency exchanges, DeFi platforms, venture capital funds, wallet providers, and software developers. On March 31, 2026, the group executed a supply chain compromise of the axios npm package — which receives over 100 million weekly downloads — deploying the WAVESHAPER.V2 cross-platform remote access trojan to approximately 600,000 installations during a three-hour exposure window.

Connected Entities

6 entities · 60 linked investigations
Organizations
□Axios npm Supply Chain Attack (March 2026)4□Drift52□Citrine Sleet / AppleJeus0□Solana62□Sapphire Sleet / UNC1069
Protocols
⌂Drift Protocol18
Relationships
  • Citrine Sleet / AppleJeus→mentioned with→Drift Protocol(80%)
  • Axios npm Supply Chain Attack (March 2026)→mentioned with→Sapphire Sleet / UNC1069(80%)
  • Drift Protocol→mentioned with→Citrine Sleet / AppleJeus(80%)
  • Sapphire Sleet / UNC1069→mentioned with→Axios npm Supply Chain Attack (March 2026)(80%)
  • Sapphire Sleet / UNC1069→mentioned with→Citrine Sleet / AppleJeus(80%)
  • Sapphire Sleet / UNC1069→mentioned with→Drift Protocol(80%)
  • Solana→mentioned with→Drift Protocol(80%)
  • Drift→mentioned with→Solana(80%)
  • Citrine Sleet / AppleJeus→mentioned with→Solana(60%)
  • Citrine Sleet / AppleJeus→mentioned with→Drift(85%)
  • + 3 more
Also appears in
Drift Protocol·52Citrine Sleet / AppleJeus·0Axios npm Supply Chain Attack (March 2026)·4Jump Trading·42OpenZeppelin AI Exploit Threat Vector·15Shibarium·28Sky (MakerDAO)·51SIGMA Bot·4Crossmint·70Teraswitch (Solana validator hosting concentration incident)·52+ 50 more

Connected Through

6 shared actors · 402 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Sapphire Sleet / UNC1069?

Timeline(12 events)

April 2018

UNC1069 becomes active (earliest tracked date per Google Mandiant), focusing on cryptocurrency exchanges in the United States and Japan.

Tenable FAQ on UNC1069 axios attack

June 2020

ClearSky publishes CryptoCore report tracking the group's estimated $200 million minimum theft from cryptocurrency exchanges since 2018.

The Hacker News — Google Attributes Axios npm Supply Chain Attack to UNC1069

March 2020

Microsoft begins tracking the threat cluster as Sapphire Sleet, identifying it as a North Korean nation-state actor targeting the cryptocurrency sector.

Microsoft Security Blog — Mitigating the Axios npm supply chain compromise

22 November 2024

Microsoft presents at CYBERWARCON noting Sapphire Sleet stole over $10 million in cryptocurrency from multiple companies over a six-month window, using fake VC and recruiter social engineering lures.

Microsoft Security Blog — CYBERWARCON threat intelligence

October 2025

Concurrent DPRK-linked group (UNC4736 / Citrine Sleet) begins six-month social engineering operation against Drift Protocol Security Council members, posing as a quantitative trading firm at a major crypto conference.

The Hacker News — Drift $285M DPRK nonce attack

February 2026

Google Threat Intelligence publishes report documenting UNC1069's deployment of AI-generated deepfakes, fake Zoom and Teams meetings, ClickFix infection vectors, and a seven-family malware arsenal including WAVESHAPER, HYPERCALL, and SILENCELIFT.

The Hacker News — North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations

30 March 2026

Attacker publishes clean decoy package plain-crypto-js@4.2.0 to the npm registry at 05:57 UTC. Malicious plain-crypto-js@4.2.1 published at 23:59 UTC.

Tenable FAQ on UNC1069 axios attack

31 March 2026

axios@1.14.1 published at 00:21 UTC and axios@0.30.4 at approximately 01:00 UTC with WAVESHAPER.V2 payload. Socket.dev detects the compromise at 00:05 UTC (approximately 6 minutes after plain-crypto-js@4.2.1 publication). Both malicious axios versions removed from npm registry at approximately 03:15 UTC. Approximately 600,000 installations occur during the roughly 3-hour exposure window.

CISA Alert; SANS Emergency Briefing; Tenable FAQ

April 2026

Microsoft publishes initial attribution blog post identifying Sapphire Sleet as the threat actor behind the axios compromise. Drift Protocol loses $285 million in a separate DPRK-linked durable nonce attack attributed to UNC4736/Citrine Sleet.

Microsoft Security Blog; The Hacker News

2 April 2026

Google Mandiant confirms attribution of axios attack to UNC1069, publishing technical details and infrastructure overlaps linking the operation to prior UNC1069 WAVESHAPER deployments via AstrillVPN node.

SANS Emergency Briefing

16 April 2026

Microsoft publishes a follow-on technical post dissecting Sapphire Sleet's macOS intrusion chain, covering credential theft and elevation of privilege techniques.

Microsoft Security Blog — Dissecting Sapphire Sleet's macOS intrusion

20 April 2026

CISA publishes formal alert on the axios npm supply chain compromise with technical IOCs, affected version list, safe downgrade targets, and mitigation guidance.

CISA Alert
Provenance & Audit Trail
Anchored on SolanaVerify on-chain15 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 15 of 17 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-code-investigator

generated: 6/19/2026, 11:05:13 PM

last updated: 7/27/2026, 10:56:26 AM

2 views

avoid.net — verified advice for a post-truth world