Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #6[disputed][awaiting moderator]in section: Concurrent DPRK Activity: Drift Protocol $285 Million Hack

   “URL path /76202033 on C2 host.”

   reviewerC2 URL path /76202033Microsoft gives /6202033 rather than /76202033. Public reporting of this IoC varies, so the reviewer or a human should confirm against Unit 42 or Tenable before applying. The page also attributes the IoC list to CISA and Tenable, but CISA lists only the domain.
   Proposed correction (not yet applied)

   URL path /6202033 on C2 host.
   citedwww.cisa.gov/news-events/alerts/2026/04/…-package-manager

No source the reviewer could reach confirms or contradicts the claim.

1. #2[unverifiable][awaiting moderator]in section: Cryptocurrency and Developer Ecosystem Targeting

   “CISA's April 2026 advisory confirmed that credentials targeted during the axios compromise included GitHub personal access tokens, AWS keys, Azure credentials, SSH keys, and cloud tokens.”

   reviewerCISA's advisory confirmed the credentials targeted in the axios compromiseThe fetched CISA alert is shorter than the page implies. Several other CISA-attributed details (file artifacts, URL path, the 'min-release-age=7' and MFA guidance, signature 87121) were not found in it either, and the Palo Alto detection items belong to Unit 42.
   citedwww.cisa.gov/news-events/alerts/2026/04/…-package-manager
2. #3[unverifiable][awaiting moderator]in section: March 31, 2026 Axios npm Supply Chain Attack

   “During that window, approximately 600,000 installations of the trojanized packages occurred.”

   reviewerApproximately 600,000 installs during a roughly three-hour window, with specific UTC timestampsNot found in the CISA, Microsoft or Unit 42 pages I could read. SANS, Tenable and Socket were not checked, so this may be supported there. Same applies to the 05:57/23:59/00:05/00:21/03:15 UTC times. The timeline[7] entry cites CISA for these, which does not contain them.
   citedwww.cisa.gov/news-events/alerts/2026/04/…-package-manager
3. #8[unverifiable][awaiting moderator]in section: Historical Activity and Prior Campaigns

   “On April 1, 2026 — the same day that attribution for the axios attack was confirmed — Drift Protocol, a Solana-based decentralized exchange, lost approximately $285 million”

   reviewerThe Drift Protocol attack occurred the same day attribution for axios was confirmed and was attributed to UNC4736I did not fetch the Drift sources, so this is not scored against the page. The page's own timeline places the Drift loss in April 2026 with no day. Worth a human check of the exact date, since the 'same day' framing and the 'coordination' inference are editorial.
   citedthehackernews.com/2026/04/drift-loses-28…-in-durable.html

The cited evidence supports part of the claim but not all of it.

1. #1[partially supported][awaiting moderator]in the timeline

   “Microsoft begins tracking the threat cluster as Sapphire Sleet, identifying it as a North Korean nation-state actor targeting the cryptocurrency sector.”

   reviewerMicrosoft began tracking the cluster as Sapphire Sleet in March 2020Microsoft's post gives an activity date, not a tracking-start date. The timeline entry overstates it. The section prose ('dating the designation to at least March 2020') has the same issue.
   citedwww.microsoft.com/en-us/security/blog/20…hain-compromise/
2. #4[partially supported][awaiting moderator]in the timeline

   “2026-04-02”

   reviewerGoogle Mandiant confirmed UNC1069 attribution on April 2, 2026The Hacker News dates Google's attribution article April 1 (updated April 3), so April 2 is not clearly right. No correction proposed because the true date was not established. The summary of the page also says attribution was 'confirmed' on April 1 in the Drift section, which conflicts with this timeline entry.
   citedwww.sans.org/blog/what-we-learned-axios-…ergency-briefing

The cited evidence supports the claim as written.

1. #5[confirmed][no action needed]in section: Threat Actor Identity and Attribution

   “CrowdStrike attributed the March 2026 axios operation to Stardust Chollima with moderate confidence, reflecting some divergence in vendor tracking methodology.”

   reviewerAttribution to Sapphire Sleet/UNC1069 and CrowdStrike moderate-confidence link to Stardust Chollima; WAVESHAPER.V2 evolved from WAVESHAPER; group active since 2018Core attribution holds. The 'divergence in vendor tracking methodology' clause is editorial. The page's claim that CISA supports the attribution is not backed, since CISA names no actor.
   citedthehackernews.com/2026/04/google-attribu…-npm-supply.html
2. #7[confirmed][no action needed]in section: WAVESHAPER.V2 Malware: Technical Profile

   “Primary C2 infrastructure: domain sfrclak[.]com, IP 142.11.206[.]73 on port 8000.”

   reviewerDomain, IP, port 8000, malicious versions, downgrade targets, 15-second self-delete, 60-second beaconBasic technical profile matches Unit 42 and Microsoft. Fine-grained items (XOR key, file paths, command names, Huntress and Wiz counts) were not individually verified.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/