Google Threat Intelligence Group (GTIG)

Force in Play

Attributed the Axios attack to UNC1069

Axios is installed in roughly 80% of cloud and code environments and downloaded over 100 million times per week. On March 31, 2026, a North Korean hacking group hijacked the npm account of its lead maintainer and published two backdoored versions with a cross-platform remote access trojan. They were live for nearly three hours before being noticed. Google's Threat Intelligence Group formally attributed the attack to UNC1069, a financially motivated North Korean threat cluster active since at least 2018.

Updated May 30