Threat Actor Unknown origin

STARDUST CHOLLIMA

Also known as: Sapphire Sleet

Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA (activities of which have been public reported as part of the “Lazarus Group”), because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017.

Indicators of Compromise 4

Package axios Package chalk Package debug Package typo-crypto

MITRE ATT&CK TTPs 7

T1027
Obfuscated Files or Information
Defense Evasion
 T1029
Scheduled Transfer
Exfiltration
 T1059
Command and Scripting Interpreter
Execution
 T1071.001
Web Protocols
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1195.002
Compromise Software Supply Chain
Initial Access
 T1610
Deploy Container
Defense Evasion

Source Articles

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
Amazon has linked multiple npm supply-chain attacks to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima) with medium confidence. The attacks began in March 2025 with the compromise of the typo-crypto package, followed by the trojanization of widely used packages debug and chalk in September 2025, impacting an estimated 10% of cloud environments within two hours. In March 2026, the axios library—used by over 100 million developers weekly—was targeted, with malicious updates distributed after attackers socially engineered maintainers to gain access. The campaign used sophisticated tactics including delayed execution in real environments, multi-stage payloads, and 'slopsquatting' of AI-hallucinated package names to expand reach.
bleeping-computer ·2h ago