Hunters Rapid Response Outage History

Started Mar 31, 2026, 11:40 AM UTC· resolved Mar 31, 2026, 03:56 PM UTC

1. identified Mar 31, 2026, 11:40 AM UTC

   Dear Customers, Team Axon is actively monitoring a recent supply chain compromise affecting the widely used NPM package axios, which introduces significant risk across enterprise environments relying on this dependency. Axios Compromise: Malicious versions of the axios package were published to NPM, embedding a remote access trojan. These versions were capable of establishing outbound connections to attacker-controlled infrastructure, enabling remote command execution and potential data exfiltration from affected systems. The compromise is particularly concerning due to Axios’s widespread use in both frontend and backend applications, increasing the likelihood of downstream impact across development pipelines and production environments. This incident exposes organizations to: - Unauthorized remote access to affected systems through embedded backdoor functionality. - Execution of attacker-controlled commands within application environments. - Potential exfiltration of sensitive data, including credentials and application data. - Supply chain propagation through dependent applications and services. Our team continues to assess the scope and technical details of this compromise. In case we identify strong indications of exposure within your environment, we will reach out directly. For further assistance or validation, please contact us. Sincerely, Team Axon NPM Packages: [email protected] [email protected] IOCS: IPs: 142.11.206.73 Domains: sfrclak[.]com File Hashes: 2553649f2322049666871cea80a5d0d6adc700ca d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 07d889e2dadce6f3910dcbc253317d28ca61c766

2. resolved Mar 31, 2026, 03:56 PM UTC

   Dear Customers, Following recent reports regarding the Axios NPM package compromise, we have continued our threat-focused hunting efforts, specifically reviewing IOC hits and related TTPs associated with this campaign. Axon reports have been published for Team Axon customers. These reports include: A consolidated list of relevant IOCs Threat hunting queries Threat hunting results across applicable environments Any findings that may require your attention are highlighted within your Axon report. If you have any questions or require further assistance, please do not hesitate to reach out. Best regards, Team Axon

Read the full incident report →

Started Sep 18, 2025, 10:04 AM UTC· resolved Sep 18, 2025, 01:12 PM UTC

1. identified Sep 18, 2025, 10:04 AM UTC

   Dear Customers, Team Axon is closely tracking multiple ongoing NPM supply chain compromises that have impacted widely used packages and present a significant risk across enterprise environments. These incidents highlight the growing threat of dependency hijacking and malicious package injection. Qix Compromise: Attackers phished the account of a maintainer (Qix), allowing them to publish malicious versions of highly popular packages such as chalk and debug. The injected payload was designed to hijack cryptocurrency transactions in browser contexts. CrowdStrike Compromise: Malicious versions of several NPM packages, including eslint-config-prettier, were distributed after attacker access. These carried the Scavenger malware, capable of exfiltrating browser data, authentication tokens, and other sensitive information. Shai-Hulud Worm: A self-propagating campaign compromised more than 180 NPM packages. This worm steals secrets and tokens (e.g., GitHub, AWS, NPM) and republishes new infected package versions under compromised maintainer accounts, enabling rapid spread. These compromises expose organizations to: - Theft of source code, tokens, and credentials stored in build pipelines. - Execution of malicious code during package installation or runtime. - Propagation of malicious dependencies downstream, impacting customers and partners. - Increased phishing and credential-stuffing risks tied to stolen data. Our team continues to investigate the scope and technical details of this campaign. In case we observe strong indications for compromised users, we will contact the customer directly. For further assistance, please reach out to us. Sincerely, Team Axon IOCs Shai-Hulud: Hashes 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09 b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777 dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c 4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db URL hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7 CrowdStrike: Domains npnjs[.]com firebase[.]su dieorsuffer[.]com smartscreen-api[.]com Hashes 32d0dbdfef0e5520ba96a2673244267e204b94a49716ea13bf635fa9af6f66bf c68e42f416f482d43653f36cd14384270b54b68d6496a8e34ce887687de5b441 5bed39728e404838ecd679df65048abcb443f8c7a9484702a2ded60104b8c4a9 URLs https[:]//firebase[.]su/c/k2 https[:]//dieorsuffer[.]com/c/k2 https[:]//smartscreen-api[.]com/c/k2

2. identified Sep 18, 2025, 01:12 PM UTC

   Dear Customers, Following our recent update regarding the NPM Supply Chain Trio - Qix, CrowdStrike, Shai-Hulud, we have continued our threat-focused hunting efforts, specifically reviewing IOC hits and related TTPs. Axon reports have been published for Team Axon customers. These reports include: - A consolidated list of IOCs - Hunting queries - TP results for relevant environments Any findings requiring your attention are highlighted in your Axon report. We will continue to closely monitor developments related to the NPM Supply Chain Trio - Qix, CrowdStrike, Shai-Hulud, and provide updates as necessary. If you have any questions or need further assistance, please do not hesitate to reach out. Best regards, Team Axon

3. resolved Sep 18, 2025, 01:12 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Sep 04, 2025, 10:49 AM UTC· resolved Sep 04, 2025, 03:52 PM UTC

1. identified Sep 04, 2025, 10:49 AM UTC

   Dear Customers, Team Axon is aware of a significant ongoing security incident involving the compromise of OAuth tokens issued to the Salesloft Drift application. These tokens have been abused by a threat actor (tracked as UNC6395) to access Salesforce instances and other integrated systems without directly breaching Salesforce itself. This activity has enabled attackers to execute structured SOQL queries, enumerate and exfiltrate sensitive data (including customer records, credentials, and access tokens), and, in some cases, delete Salesforce jobs to obscure traces. Evidence suggests that additional connected integrations (e.g., Google Workspace via Drift Email, and others) may also be impacted. In certain integrations, such as Google → Drift Email, attackers were able to abuse OAuth tokens to authenticate and access the integration account, allowing them to query emails, extract information, and potentially access additional data. Early threat intelligence confirms that this campaign is widespread and actively exploited in the wild, with high-profile organizations already affected. The breadth of Drift integrations (nearly 60 third-party platforms) significantly increases the potential exposure across enterprise environments. Recommendations: - Revoke OAuth tokens associated with Drift and related integrations. - Disable or remove the Drift application from Salesforce until security assurances are provided. - Rotate exposed credentials, especially API keys, AWS access tokens, Snowflake tokens, and any secrets stored in Salesforce fields. - Make sure Salesforce logs are being ingested into the Hunters platform. - Review connected integrations to Drift (Slack, Pardot, Zoom, etc.) and revoke any unnecessary permissions. Affected organizations are at heightened risk of targeted phishing campaigns stemming from the exposure of customer and employee data. Teams must remain on high alert, closely monitor for suspicious activity, and reinforce phishing awareness among users Our team continues to investigate the scope and technical details of this campaign. In case we observe strong indications for compromised users, we will contact the customer directly. For further assistance, please reach out to us. Sincerely, Team Axon Current IOCs: - IP Addresses: 208.68.36.90 44.215.108.109 154.41.95.2 176.65.149.100 179.43.159.198 185.130.47.58 185.207.107.130 185.220.101.133 185.220.101.143 185.220.101.164 185.220.101.167 185.220.101.169 185.220.101.180 185.220.101.185 185.220.101.33 192.42.116.179 192.42.116.20 194.15.36.117 195.47.238.178 195.47.238.83 - Potentially Related User Agents: Salesforce-Multi-Org-Fetcher/1.0 Salesforce-CLI/1.0

2. resolved Sep 04, 2025, 03:52 PM UTC

   Dear Customers, Following our recent update regarding the Salesloft Drift OAuth Token Compromise, we have continued our threat-focused hunting efforts, specifically reviewing IOC hits and related TTPs. Axon reports have been published for Team Axon customers. These reports include: - A consolidated list of IOCs - Hunting queries - TP results for relevant environments Any findings requiring your attention are highlighted in your Axon report. We will continue to closely monitor developments related to the Salesloft Drift OAuth Token Compromise and provide updates as necessary. If you have any questions or need further assistance, please do not hesitate to reach out. Best regards, Team Axon

Read the full incident report →

Started Jul 21, 2025, 10:34 AM UTC· resolved Jul 22, 2025, 05:23 PM UTC

1. investigating Jul 21, 2025, 10:34 AM UTC

   Team Axon is aware of a newly disclosed critical vulnerability, CVE-2025-53770, affecting Microsoft SharePoint Server (on-premise). This flaw enables remote code execution when specially crafted requests are sent to a vulnerable SharePoint instance. Exploitation does not require authentication, making this a high-risk vulnerability for exposed environments. This issue arises from improper input validation within core SharePoint components, and successful exploitation may allow attackers to execute arbitrary code with the privileges of the SharePoint application. We’ve observed early threat intelligence and public Proof-of-Concept (PoC) code surfacing as well as indications that this CVE is being actively exploited in the wild, increasing the urgency for immediate action. Detection Coverage: - It is important to note that existing detections are expected to identify this activity As an example: - Suspected WebShell execution using common binary - This detector detects suspicious parent-child relationships of web server processes and commonly abused binaries to reveal the existence of a web shell. - Rare child process of commonly abused binary - Detects process execution chains in which the child process is a built-in or "living-off-the-land" system binary, such as w3wp.exe. Recommendations: - Use or upgrade to a supported SharePoint version: - SharePoint Server 2016, 2019, SharePoint Subscription Edition - Make sure SharePoint is patched to the latest version: - SharePoint 2019 - KB 5002741 - Build 16.0.10417.20027 - SharePoint 2016 - KB 5002744 - Build 16.0.5508.1000 - If a patch/update is not an option, consider restricting external access to SharePoint servers. Our team is actively researching the details and will provide updates after deeply analyzing and assessing the vulnerability, including potential deliverables such as threat hunting queries and visibility insights. Impacted customers will be notified directly. For further assistance, please don't hesitate to contact us. Sincerely, Team Axon

2. resolved Jul 22, 2025, 05:23 PM UTC

   Dear Customers, Following our recent update regarding the SharePoint CVE - CVE-2025-53770, we continued with the threat-focused hunting efforts, looking for suspicious IOC hits and TTPs. Axon reports have been published for Team Axon customers, including a list of IOCs, IOC Sweep results, hunting queries, and hunting results. Relevant hits that require your attention will be mentioned in the AXON report. Microsoft released new patches to handle the relevant CVEs which can be found in this link https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ SharePoint 2019 - KB 5002753,KB5002754 - Build 16.0.10417.20037 SharePoint 2016 - KB 5002759, KB 5002760 - Build 16.0.5513.1001 Microsoft SharePoint Server Subscription Edition - KB5002768 - Build 16.0.18526.20508 We continue to monitor CVE-2025-53770 and will provide further updates as necessary. If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team Axon

Read the full incident report →

Started Apr 22, 2025, 10:57 AM UTC· resolved Apr 23, 2025, 01:18 PM UTC

1. investigating Apr 22, 2025, 10:57 AM UTC

   Team Axon is aware of a new critical RCE flaw (CVE-2025-32433) affecting Erlang/OTP SSH daemon. This vulnerability allows remote unauthenticated code execution due to a logical race condition issue. Attackers can send crafted SSH packets to exploit this flaw, which can potentially lead to unauthenticated arbitrary code execution, potentially with root privileges. We’ve observed the publication of several Proof-of-Concepts related to this vulnerability. Recommendations: - Upgrade your Erlang/OTP installation to one of the following - OTP-27.3.3 - OTP-26.2.5.11 - OTP-25.3.2.20 - If you’re using a vendor-supplied Erlang distribution (e.g., part of a Cisco or Ericsson product), monitor for official updates. - If a patch/update is not an option, consider: - Restricting access to the SSH port to trusted IPs only. - Use firewall rules to block access from untrusted networks - Disable Erlang/OTP-based SSH if it's not essential. Our team is actively researching the details and will provide updates after deeply analyzing and assessing the vulnerability, including potential deliverables such as threat hunting queries and visibility insights. Impacted customers will be notified directly. For further assistance, please don't hesitate to contact us. Sincerely, Team Axon

2. resolved Apr 23, 2025, 01:18 PM UTC

   Dear Customers, Following our recent update regarding the Erlang/OTP RCE vulnerability (CVE-2025-32433), we continued with the threat-focused hunting efforts, looking for machines running vulnerable versions of the Erlang/OTP SSH Package Axon reports have been published for Team Axon customers, including a list of deliverables. Relevant hits that require your attention will be mentioned in the AXON report. We continue to monitor CVE-2025-32433 and will provide further updates as necessary. If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team Axon

Read the full incident report →

Started Apr 09, 2025, 10:52 AM UTC· resolved Apr 14, 2025, 08:15 AM UTC

1. investigating Apr 09, 2025, 10:52 AM UTC

   Team Axon is aware of a recently disclosed Remote Code Execution (RCE) vulnerability affecting several Ivanti products related to VPN functionality. The vulnerability, CVE-2025-22457, is a stack-based buffer overflow that impacts the following Ivanti versions: - Ivanti Connect Secure prior to version 22.7R2.6 - Ivanti Policy Secure prior to version 22.7R1.4 - Ivanti ZTA Gateways prior to version 22.8R2.2 - Pulse Connect Secure (EoS) prior to version 9.1R18.9 This flaw allows a remote, unauthenticated attacker to achieve remote code execution. While no public Proof-of-Concept (PoC) exploit has been released, the vulnerability is known to have been exploited in the wild. To reduce risk, we strongly recommend: - Applying available security patches to all affected Ivanti applications and appliances. (Note: Some patches may not yet be available; we advise monitoring vendor updates closely Team Axon is actively investigating customer environments for any signs of exploitation. Should we identify affected systems, impacted customers will be notified directly. If you have any questions or require assistance, please don’t hesitate to reach out. Sincerely, Team Axon

2. resolved Apr 14, 2025, 08:15 AM UTC

   Dear Customers, Following our recent update regarding the Ivanti VPN RCE vulnerability (CVE-2025-22457), we continued with the threat-focused hunting efforts, looking for suspicious IOC hits. Axon reports have been published for Team Axon customers, including a list of IOCs and IOC Sweep results. Relevant hits that require your attention will be mentioned in the AXON report. We continue to monitor CVE-2025-22457 and will provide further updates as necessary. If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team Axon

Read the full incident report →

Started Mar 27, 2025, 04:04 PM UTC· resolved Mar 30, 2025, 08:03 AM UTC

1. investigating Mar 27, 2025, 04:04 PM UTC

   On March 21, 2025, A major security incident was reported involving Oracle Cloud’s authentication systems. A threat actor known as “rose87168” has claimed responsibility for the breach, alleging the theft of 6 million records affecting over 140,000 tenants. The compromised data is said to include: - JKS (Java KeyStore) files - Encrypted SSO and LDAP credentials - JPS (Java Platform Security) keys The attacker claims to have accessed login endpoints belonging to Oracle: login..oraclecloud.com While Oracle has publicly denied that a breach occurred, multiple independent sources have claimed to have verified the authenticity of the stolen data, which allegedly contains production information from impacted customers. This incident remains under active evaluation, we are committed to providing timely updates, insights, and recommendations to ensure our customers remain secure. A detailed AXON report outlining our findings, insights, and recommended actions will be shared upon the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON

2. resolved Mar 30, 2025, 08:03 AM UTC

   This incident is currently being actively monitored by Team Axon. Any new information or developments will be promptly updated on this page. If you have any questions or concerns, please feel free to contact us. Sincerely, Team Axon

Read the full incident report →

Started Mar 16, 2025, 06:11 AM UTC· resolved Mar 23, 2025, 11:52 AM UTC

1. investigating Mar 16, 2025, 06:11 AM UTC

   Dear Customers, Team AXON is actively monitoring and assessing a recently disclosed CI/CD supply-chain attack involving the widely used tj-actions/changed-files GitHub Action. This action was compromised with a malicious payload designed to potentially exfiltrate CI/CD secrets, exposing them through GitHub Actions build logs. Key Technical Details and Initial Recommendations: 1. Increased Risk for Public Repositories – Publicly accessible workflow logs pose a higher risk, as they may allow threat actors to extract secrets directly. 2. Malicious Commit – Most existing release tags were altered to point to the same malicious commit (hash: 0e58ed8671d6b60d0890c21b07f8835ace038e67). The attacker modified tags to reference the malicious commit, affecting prior versions as well. 3. Until the investigation concludes, we strongly advise stopping the use of any version of tj-actions/changed-files. 4. Complete Removal Across All Branches – Remove all references to this action from all branches, not just the main branch, to prevent unintended execution. 5. Code Search for Exposure – Conduct a thorough search across organizational repositories to identify any usage of tj-actions/changed-files. 6. Secret Rotation if Exposure is Detected – If any secrets were compromised, immediate rotation is advised. 7. Handling Workflow Logs – Deleting the affected workflow can reduce the risk of further exposure. However, for forensic analysis, we recommend retaining a secure copy of the log contents from the exposure window before deletion. This incident remains under active evaluation, we are committed to providing timely updates, insights, and recommendations to ensure our customers remain secure. A detailed AXON report outlining our findings, insights, and recommended actions will be shared upon the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON

2. investigating Mar 18, 2025, 05:48 PM UTC

   Dear Customers, Team AXON continues to monitor and assess a recently disclosed CI/CD supply-chain attack affecting the widely used tj-actions/changed-files GitHub Action. According to the latest reports, the scope of this attack extends beyond a single action, with additional compromised GitHub Actions identified. Below is a brief update on the current RR state 1. AXON reports were shared with all the customers for which we identified any indication for potential usage of the tj-actions/changed-files GitHub Action based on ingested GitHub audit logs. However, it is important to note that GitHub audit logs do not provide sufficient details to definitively confirm whether other customers have used or are currently using the affected GitHub Action. 2. Hence, it is recommended to follow our previously shared recommendations and conduct a thorough search across organizational repositories to identify any usage of tj-actions/changed-files. 3. Important update: According to latest publications, there is a high likelihood that additional GitHub Actions were compromised prior to tj-actions/changed-files, including multiple reviewdog actions, such as reviewdog/action-setup. While this particular action is significantly less popular, the nature of the threat remains similar and requires the same level of response measures to mitigate potential risks effectively. 4. It is recommended to conduct a search in organizational repositories to identify any usage of reviewdog actions as well. Here are examples for GitHub search queries that can be used to identify the usage of relevant GitHub actions in your organization. Please modify the "" placeholder to your actual organization name: a. https://github.com/search?q=org%3A+(reviewdog%2Faction-setup+OR+reviewdog%2Faction-shellcheck+OR+reviewdog%2Faction-composite-template+OR+reviewdog%2Faction-staticcheck+OR+reviewdog%2Faction-ast-grep+OR+reviewdog%2Faction-typos+OR+tj-actions%2Fchanged-files)+language%3AYAML+path%3A.github%2F&type=code b. https://github.com/search?q=org%3A%20uses%3A%20tj-actions%2Fchanged-files%20language%3AYAML%20path%3A.github%2F&type=code c. https://github.com/search?q=org%3A+reviewdog+language%3AYAML+path%3A.github%2F&type=code 5. Based on the information available so far, the expected behavior of the compromised actions remains consistent—attempting to dump secrets into Workflow Logs. However, it is important to note that not all malicious commits deployed by the threat actor contained the same curl command to fetch the malicious payload from Gist, indicating potential variations in the attack execution. Sections 6 to 8 outline the same recommendations we previously provided, all of which are relevant and strongly recommended for addressing any findings related to the compromised actions: 6. Complete Removal Across All Branches – Remove all references to the potentially compromised actions from all branches, not just the main branch, to prevent unintended execution. 7. Secret Rotation if Exposure is Detected – If any secrets were compromised, immediate rotation is advised. 8. Handling Workflow Logs – Deleting the affected workflow can reduce the risk of further exposure. However, for forensic analysis, we recommend retaining a secure copy of the log contents from the exposure window before deletion. This incident remains under active evaluation, we are committed to providing timely updates, insights, and recommendations to ensure our customers remain secure. A detailed AXON report outlining our findings, insights, and recommended actions will be shared upon the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON.

3. investigating Mar 18, 2025, 06:54 PM UTC

   Dear customers, We are re-sharing Section 4 to include a previously missing part. Please refer to this updated version for the complete details. 4. It is recommended to conduct a search in organizational repositories to identify any usage of reviewdog actions as well. Here are examples for GitHub search queries that can be used to identify the usage of relevant GitHub actions in your organization. Please modify the insert-your-github-org-name placeholder to your actual organization name: a. https://github.com/search?q=org%3Ainsert-your-github-org-name+(reviewdog%2Faction-setup+OR+reviewdog%2Faction-shellcheck+OR+reviewdog%2Faction-composite-template+OR+reviewdog%2Faction-staticcheck+OR+reviewdog%2Faction-ast-grep+OR+reviewdog%2Faction-typos+OR+tj-actions%2Fchanged-files)+language%3AYAML+path%3A.github%2F&type=code b. https://github.com/search?q=org%3Ainsert-your-github-org-name%20uses%3A%20tj-actions%2Fchanged-files%20language%3AYAML%20path%3A.github%2F&type=code c. https://github.com/search?q=org%3Ainsert-your-github-org-name+reviewdog+language%3AYAML+path%3A.github%2F&type=code

4. investigating Mar 20, 2025, 10:31 AM UTC

   Dear Customers, Our team, AXON, is continuing in-depth threat research on the ongoing series of GitHub Actions supply chain attacks. In the meantime, all customers for whom relevant GitHub audit logs have been identified now have access to their published AXON reports in the Hunters portal. 1. Below is the latest list of potentially compromised GitHub Actions: tj-actions/changed-files tj-actions/eslint-changed-files reviewdog/action-setup reviewdog/action-shellcheck reviewdog/action-composite-template reviewdog/action-staticcheck reviewdog/action-ast-grep reviewdog/action-typos Note: At this point, there is a possibility that additional compromised GitHub Actions related to Reviewdog have yet to be disclosed. 2. Below is the latest list of GitHub search queries that can help identify the use of potentially compromised GitHub Actions within your GitHub organization: https://github.com/search?q=org%3Ainsert-your-github-org-name%20uses%3A%20tj-actions%2Fchanged-files%20language%3AYAML%20path%3A.github%2F&type=code https://github.com/search?q=org%3Ainsert-your-github-org-name+(reviewdog%2Faction-setup+OR+reviewdog%2Faction-shellcheck+OR+reviewdog%2Faction-composite-template+OR+reviewdog%2Faction-staticcheck+OR+reviewdog%2Faction-ast-grep+OR+reviewdog%2Faction-typos+OR+tj-actions%2Fchanged-files+OR+tj-actions%2Feslint-changed-files)+language%3AYAML+path%3A.github%2F&type=code https://github.com/search?q=org%3Ainsert-your-github-org-name+reviewdog+language%3AYAML+path%3A.github%2F&type=code If you need further assistance with follow-up investigation steps, including reviewing GitHub workflow logs, please feel free to reach out to Team AXON via an AXON request. Sincerely, Team AXON.

5. investigating Mar 21, 2025, 09:38 AM UTC

   Dear Customers, As part of our ongoing response, we’ve created tools to help you identify exposed secrets in your GitHub Actions logs. 1. Log Fetching Script - Automatically retrieves GitHub Actions workflow logs for a repository: a. Linux/macOS version: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/linux_fetch_github_workflow_logs.sh b. Windows PowerShell version: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/windows_fetch_github_workflow_logs.ps1 c. If you prefer not to use the provided scripts, you can download logs manually via the GitHub UI: 1. Go to your repository's Actions tab. 2. Open a workflow run you’d like to inspect. 3. Click the “Download logs” button in the upper-right corner of the workflow page. 4. Save and extract the logs locally. 5. Run the scanner script on the extracted logs. 2. Secret Scanner - A Python script that scans the downloaded logs for secrets potentially exfiltrated via the compromised action. a. Scanner script: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/cve_2025_30066_scanner.py If you encounter false positives or unexpected findings while using the tool, we encourage you to reach out and share your insights with us. Sincerely, Team AXON.

6. resolved Mar 23, 2025, 11:52 AM UTC

   Dear Customers, This Rapid Response campaign is now concluded. 1. AXON reports are now available for AXON customers and can be found in the Hunters portal. 2. A blog post that highlights the key elements of the attack flow, with a focus on the large-scale campaign was published by the team and can be found on the Hunters' website: https://www.hunters.security/en/blog/github-actions-supply-chain-attack a. It includes a summary diagram, recommended action items, an explanation of the investigation tool, and more. 3. as mentioned in our previous rapid response updates, the team also created tools to help with the identification of exposed secrets in GitHub Actions logs: a. Log Fetching Script (Linux/MacOS Version) - Automatically retrieves GitHub Actions workflow logs for a repository: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/linux_fetch_github_workflow_logs.sh b. Log Fetching Script (Windows Version) - Automatically retrieves GitHub Actions workflow logs for a repository: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/windows_fetch_github_workflow_logs.ps1 c. Secret Scanner - A Python script that scans the downloaded logs for secrets potentially exfiltrated via the compromised action: https://github.com/axon-git/rapid-response/blob/main/GitHub%20Actions%20Supply%20Chain%20-%20tj-actions_reviewdog/cve_2025_30066_scanner.py If you encounter any findings that require further assistance, please feel free to reach out. Sincerely, Team AXON.

Read the full incident report →

Started Mar 03, 2025, 06:59 AM UTC· resolved Mar 03, 2025, 04:08 PM UTC

1. investigating Mar 03, 2025, 06:59 AM UTC

   Dear Customers, Team AXON is aware of an ongoing password spraying campaign leveraging the FastHTTP library to target Entra ID and Microsoft 365. In this campaign, the threat actor operates a botnet of over 130,000 compromised devices, exploiting non-interactive sign-ins via basic authentication. FastHTTP is a high-performance HTTP server and client library for the Go programming language, designed to handle HTTP requests more efficiently than Go’s standard net/http package. The campaign poses significant risks to systems that rely on default or weak authentication methods, highlighting the importance of robust password policies and MFA. Our team has initiated a targeted investigation to identify potential IOCs related to this campaign. If any critical findings are discovered that require immediate attention, we will promptly inform you. An AXON report detailing our findings, mitigation strategies, and recommended actions will be shared with all AXON customers following the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON

2. resolved Mar 03, 2025, 04:08 PM UTC

   Dear Customers, Following our recent update regarding the FastHTTP Botnet: Large-Scale Microsoft 365 Password Spraying Campaign we have conducted a threat hunting across all customers, Relevant hits that require your attention will be mentioned in the AXON report. The following queries can be used by your security teams to gain relevant visibility and also to conduct threat-based threat-hunting: 1. Hunting Query - Suspicious login attempts made using FastHTTP user agent (Azure Sign-in Logs) - This query can be found on AXON's GitHub. - Link: https://github.com/axon-git/rapid-response/blob/main/fasthttp_bruteforce_campaign/fasthttp_bruteforce_passwordspray_campaigns_azure_signin.sql 2. Hunting Query - Suspicious login attempts made using FastHTTP user agent (M365 audit logs) - This query can be found on AXON's GitHub. - Link: https://github.com/axon-git/rapid-response/blob/main/fasthttp_bruteforce_campaign/fasthttp_bruteforce_passwordspray_campaigns_m365.sql 3. Custom Detector Recommendation - Configuration suggestions by our team to create a detector for this campaign can be found in the AXON report. In addition, full AXON reports were published for team AXON customers. In those reports, you can also find the comprehensive updated deliverables list (threat hunting queries, IOCs, relevant hits if exist, and custom detector recommendation). The team is still tracking the campaign and will publish an update in case needed. If you have any questions, please do not hesitate to reach out to us. Sincerely, Team AXON.

Read the full incident report →

Started Feb 22, 2025, 04:58 PM UTC· resolved Feb 26, 2025, 12:09 PM UTC

1. investigating Feb 22, 2025, 04:58 PM UTC

   Dear Customers, Team AXON is aware of the recently leaked internal conversations associated with the Black Basta threat group and is actively investigating the matter. As reported, an unknown individual has released internal chat logs belonging to Black Basta’s ransomware operations. The leaked archive contains messages exchanged in the group’s internal chat rooms between September 2023 and September 2024. These messages include a range of sensitive information, such as potential victim credentials and other data that may serve as indicators of compromise (IOCs). Our dedicated threat research efforts remain focused on assessing the leaked information. If we identify any findings that require your immediate attention, we will notify you promptly. Additionally, a comprehensive AXON report will be provided to all AXON customers once our Rapid Response efforts are complete. If you have any questions or concerns, please do not hesitate to reach out to us. Sincerely, Team AXON.

2. investigating Feb 24, 2025, 11:54 AM UTC

   Dear Customers, We are still analyzing the leaked messages, Customers who we were able to find any mentions to in the group messages have been notified, Additionally, we are conducting a large-scale IOC scan covering the period of the chat leak. Since the IOC list is extensive, containing approximately 4,000 IP addresses, we are currently categorizing IPs based on their maliciousness to prioritize potential threats. This process takes time to ensure accuracy and completeness. We will keep you updated as we finalize the IP analysis and look for additional findings. If you have any questions or concerns, please do not hesitate to reach out to us. Sincerely, Team AXON.

3. resolved Feb 26, 2025, 12:09 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused research and hunting efforts, further evaluating the threat and looking for potential hits in your organizational infrastructures. AXON reports have been published for AXON customers, including: - Indicators of compromise - Relevant hits that require your attention Please feel free to reach out in case of any follow-up questions. Sincerely, Team AXON.

Read the full incident report →

Started Feb 16, 2025, 02:39 PM UTC· resolved Feb 17, 2025, 11:59 AM UTC

1. investigating Feb 16, 2025, 02:39 PM UTC

   Team AXON is aware of a publication about an Authentication Bypass flaw related to Palo Alto Networks, affecting PAN-OS management web interface. The flaw, identified as CVE-2025-0108, allows an unauthenticated attacker with network access to the management web interface to bypass authentication to the PAN-OS management web interface and invoke certain PHP scripts. A Proof-of-Concept exploit related to this vulnerability was published. While invoking these PHP scripts does not enable remote code execution, it can negatively impact the integrity and confidentiality of PAN-OS. to mitigate the risk, It is recommended to : - patch all the relevant PAN-OS devices. - restrict management interface access to only trusted internal IP addresses. - Threat Prevention subscription can be used to block attacks for this vulnerability by enabling Threat ID 510000 and 510001 (introduced in Applications and Threats content version 8943) The team is actively searching for evidence of exploitations of this vulnerability in our customers’ environments. In case of identification of impacted customers, they will be notified directly. Please don’t hesitate to contact us for further assistance or any relevant questions. Sincerely, Team Axon

2. resolved Feb 17, 2025, 11:59 AM UTC

   Dear Customers, Following our recent update regarding the PAN-OS vulnerability (CVE-2025-0108), we continued with the threat-focused hunting efforts, looking for suspicious requests. we have published a visibility query for detecting devices that had Malicious HTTP Request on PAN Devices based on Threat ID's 510000 and 510001 from PAN Threat Prevention alerts. It is recommended validating that this traffic didn’t target any of your organizational PAN OS devices, and if so that the devices are fully patched. The query is also available on Axon's GitHub: -PAN malicious HTTP Request alert: https://github.com/axon-git/rapid-response/blob/main/cve-2025-0108/pan_threat_logs_visibility.sql Additionally, Axon reports have also been published for Team Axon customers, including the updated list of deliverables. Relevant hits that require your attention will be mentioned in the AXON report alongside recommended investigation steps. We continue to monitor CVE-2025-0108 and will provide further updates as necessary. If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team Axon

Read the full incident report →

Started Jan 16, 2025, 09:24 AM UTC· resolved Jan 16, 2025, 05:07 PM UTC

1. identified Jan 16, 2025, 09:24 AM UTC

   Dear Customers, Team AXON is aware of an ongoing brute-force campaign leveraging the FastHTTP library, targeting Azure Active Directory Graph API. Fasthttp is a high-performance HTTP server and client library for the Go programming language, designed to handle HTTP requests more efficiently than Go’s standard net/http package. The campaign poses significant risks to systems that rely on default or weak authentication methods, highlighting the importance of robust password policies and MFA. Our team has initiated a targeted investigation to identify potential IOCs related to this campaign. If any critical findings are discovered that require immediate attention, we will promptly inform you. An AXON report detailing our findings, mitigation strategies, and recommended actions will be shared with all AXON customers following the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON

2. resolved Jan 16, 2025, 05:07 PM UTC

   Dear Customers, Following our recent update regarding the AzureAD Brute-force campaign, We have conducted a threat hunting across all customers, Relevant hits that require your attention will be mentioned in the AXON report. The following queries can be used by your security teams to gain relevant visibility and also to conduct threat-based threat-hunting: 1. Visibility Query - Azure Users Without MFA - This query can be found on Axon's GitHub. Link - https://github.com/axon-git/rapid-response/blob/main/fasthttp_bruteforce_campaign/azure_users_without_mfa.sql 2. Hunting Query - Successful login attempt made by the FastHTTP User agent - This query can be found on Axon's GitHub. Link - https://github.com/axon-git/rapid-response/blob/main/fasthttp_bruteforce_campaign/fasthttp_bruteforce_campaign.sql 3. Custom Detector Recommendation - Configuration suggestions by our team to create a detector for this campaign. In addition, Axon reports had been published to Team Axon customers. In those reports, you can also find updated deliverables list (threat hunting, visibility queries and custom detector recommendation). The team is still tracking the campaign and will publish an update in case needed. If you have any questions, please do not hesitate to reach out to us. Sincerely, Team Axon.

Read the full incident report →

Started Jan 02, 2025, 10:12 AM UTC· resolved Jan 02, 2025, 03:28 PM UTC

1. investigating Jan 02, 2025, 10:12 AM UTC

   Team AXON is monitoring the critical vulnerability affecting LDAP clients on Windows Domain Controllers. This flaw, identified as CVE-2024-49112, was published by Microsoft on December 10, 2024, with a CVSS severity score of 9.8 out of 10. Although Microsoft has disclosed the vulnerability, no public exploit or detailed blog post explaining the exploitation path was released initially. We have recently observed the publication of a Proof-of-Concept related to this vulnerability. It’s important to note, the PoC is not yet fully developed and currently results in a denial-of-service (DoS) rather than remote code execution (RCE) which drastically reduced the impact of exploitation. According to Microsoft, this vulnerability affects both LDAP clients and servers running impacted versions. To mitigate potential risks, we recommend: - Applying the latest security updates for Windows immediately to ensure protection. - If patching is not possible, restricting access by: - Blocking inbound RPC from untrusted networks to Domain Controllers. - Preventing external access to LDAP services. Our team will provide updates after deeply analyzing and assessing the vulnerability, including potential deliverables. In case of identification of impacted customers, they will be notified directly. For further assistance, please don't hesitate to contact us. Sincerely, Team Axon

2. resolved Jan 02, 2025, 03:28 PM UTC

   Dear Customers, Following our recent update regarding the LDAPNightmare vulnerability (CVE-2024-49112), we would like to update that the recently released Proof-of-Concept (PoC) is not related to CVE-2024-49112. This significantly reduces the likelihood of an RCE PoC being released. In the meantime, we have published two new hunting queries for identifying outgoing LDAP queries to external IP Addresses and incoming RPC traffic towards domain controllers from external IP Addresses, Both being observed as possible exploitation activity of CVE-2024-49112. These queries are available on Axon's GitHub: -Outgoing LDAP queries to external IP’s: https://github.com/axon-git/rapid-response/blob/main/CVE-2024-49112/ldap_queries_to_external_ip.sql -Incoming RPC traffic to domain controllers from external IP’s: https://github.com/axon-git/rapid-response/blob/main/CVE-2024-49112/external_rpc_to_dc.sql Axon reports have also been published for Team Axon customers, including the updated list of deliverables. We continue to monitor CVE-2024-49112 and will provide further updates as necessary. Should you have any questions regarding the queries or any other concerns, please don't hesitate to reach out. Sincerely, Team Axon

Read the full incident report →

Started Jan 01, 2025, 10:14 AM UTC· resolved Jan 02, 2025, 03:10 PM UTC

1. identified Jan 01, 2025, 10:14 AM UTC

   Dear Customers, Team AXON is continuing to investigate the Cyberhaven incident and has identified additional malicious chrome extensions. An updated AXON report outlining the new findings will be uploaded as soon as we conclude the investigation. If any new hits are identified in your environment you'll be notified in the updated AXON report. Please feel free to reach out in case of any follow-up questions. Sincerely, Team AXON.

2. resolved Jan 02, 2025, 03:10 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused research and hunting efforts, further evaluating the threat and looking for potential hits in your organizational infrastructures. AXON reports have been published for AXON customers, including: - New Indicators of compromise - Relevant hits that require your attention (both full list and summarized view) - Link to a GitHub repository with a list of all relevant IOCs and threat hunting queries Please feel free to reach out in case of any follow-up questions. Sincerely, Team AXON.

Read the full incident report →

Started Dec 27, 2024, 11:46 PM UTC· resolved Dec 29, 2024, 06:25 PM UTC

1. investigating Dec 27, 2024, 11:46 PM UTC

   Dear Customers, Team AXON is actively monitoring and investigating a security incident involving the Cyberhaven Chrome browser extension. According to recent reports, Cyberhaven, a data loss prevention company, alerted its customers on December 24 about a breach resulting from a successful phishing attack on an administrator account for the Google Chrome Web Store. The malicious actor compromised the employee’s account and published a tampered version of the Cyberhaven extension. This malicious version included code designed to communicate with the attacker's malicious domain. In response to this incident, Team AXON has initiated a targeted threat research and hunting effort. Our early findings suggest that the Cyberhaven extension may not be the sole product impacted by this threat actor. Evidence points to this being part of a larger, coordinated campaign affecting multiple products over recent weeks. If you or your organization uses the Cyberhaven Chrome extension, we strongly advise you to follow the vendor’s recommendations to mitigate potential risks: - Update the Cyberhaven Chrome extension to the latest secure version. - Revoke all passwords that are not FIDOv2, revoke/rotate API tokens, and review browser logs for signs of malicious activity. Our dedicated threat-hunting efforts remain focused on uncovering the full scope of this campaign. Should any significant findings require your immediate attention, we will notify you promptly. Additionally, a detailed AXON report will be provided to all AXON customers once our Rapid Response analysis is complete. If you have any questions or concerns, please do not hesitate to reach out to us. Sincerely, Team AXON

2. investigating Dec 28, 2024, 11:58 AM UTC

   Dear Customers, We would like to provide you with an update on Team AXON’s ongoing threat-research and hunting efforts. Our team is actively analyzing the current threat campaign to ensure that all relevant insights and findings are delivered to you promptly. A detailed AXON report will be shared with all AXON customers as soon as our Rapid Response analysis is finalized. In the meantime, please note that a comprehensive list of Indicators of Compromise (IOCs) related to this campaign have been uploaded to the Hunters portal as AXON IOCs. Should you have any questions or require further assistance, please do not hesitate to reach out to us. Sincerely, Team AXON

3. resolved Dec 29, 2024, 06:25 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused research and hunting efforts, further evaluating the threat and looking for potential hits in your organizational infrastructures. AXON reports have been published for AXON customers, including: - More details regarding the threat campaign - Recommended action items. - Comprehensive list of IOCs - Relevant hits that require your attention (both full list and summarized view) The team keeps tracking this threat and will update in case of significant findings. Please feel free to reach out in case of any follow-up questions. Sincerely, Team AXON.

Read the full incident report →

Started Dec 23, 2024, 06:02 PM UTC· resolved Dec 25, 2024, 09:01 AM UTC

1. investigating Dec 23, 2024, 06:02 PM UTC

   Dear customers, Team AXON is aware of an ongoing social engineering campaign, known as "Fix it". This campaign manipulates end users into manually executing malicious code. The infection process begins when a user visits a website designed to mimic legitimate sites for products or services such as Notepad++ or Microsoft Teams. Upon clicking the download button, the user is redirected to a new page that appears to be from Cloudflare, prompting a verification to confirm they are human. Instead of displaying a standard CAPTCHA, the page presents a message instructing the user to press the Windows and ‘R’ keys to open the Run command dialog and paste a malicious code into it, deceiving the user into executing the harmful code on their device. A threat-focused threat-hunting related to this campaign is now ongoing. In case of any significant finding that requires your attention, we’ll of course reach out. An AXON report will be available for all of our AXON customers as soon as the Rapid Response efforts are concluded. Please don’t hesitate to contact us in case of any questions. Sincerely, Team AXON.

2. resolved Dec 25, 2024, 09:01 AM UTC

   Dear customers, Following our latest update, we continued with the threat-focused hunting efforts, looking for indicators of compromise. Relevant hits that require your attention will be mentioned in the AXON report. Sincerely, Team AXON

Read the full incident report →

Started Dec 16, 2024, 07:20 AM UTC· resolved Dec 16, 2024, 05:00 PM UTC

1. investigating Dec 16, 2024, 07:20 AM UTC

   Team AXON is aware of a publication about a critical RCE flaw related to Cleo, affecting Cleo servers. This vulnerability, according to the publications allows a remote unauthenticated attacker to import and execute bash or PowerShell commands by exploiting the default Autorun folder settings. Cleo strongly advises all customers to immediately upgrade instances of Harmony, VLTrader, and LexiCom to the latest released patch (version 5.8.0.24) to address additional discovered potential attack vectors of the vulnerability. Customers who cannot immediately upgrade are advised to disable the Outrun feature by going into the System Options and clearing out the Autorun directory. The vulnerability is still under team AXON's evaluation, our team will provide updates after deeply analyzing and assessing the vulnerability, including potential deliverables. In case of identification of impacted customers, they will be notified directly. For further assistance, please don't hesitate to contact us. Sincerely, Team AXON

2. resolved Dec 16, 2024, 05:00 PM UTC

   Dear Customers, Following our recent update regarding the Cole vulnerability, we would like to inform you that our team is still actively researching this issue. we have published two new hunting queries for identifying PowerShell spawned from Cleo software and Java spawning suspicious powershell commands. Both being observed as possible post-exploitation activity of Cleo software. These queries are available on Axon's GitHub: -Shell execution under Cole software: https://github.com/axon-git/rapid-response/blob/main/Cleo-CVE-2024-50623/proc_creation_cleo_exploitation.sql -Java spawning suspicious powershell: https://github.com/axon-git/rapid-response/blob/main/Cleo-CVE-2024-50623/proc_creation_suspicious_powershell_from_javaw.sql Axon reports have also been published for Team Axon customers, including the updated list of deliverables. We continue to monitor the Cole vulnerability and will provide further updates as necessary. Should you have any questions regarding the queries or any other concerns, please don't hesitate to reach out. Sincerely, Team Axon

Read the full incident report →

Started Dec 04, 2024, 09:15 AM UTC· resolved Dec 04, 2024, 02:06 PM UTC

1. investigating Dec 04, 2024, 09:15 AM UTC

   Team AXON is aware of a supply chain attack that was detected in Solana's web3.js library. Compromised versions contained malicious code that was used to steal private keys from users, potentially allowing attackers to drain cryptocurrency wallets. - The affected versions of the library are 1.95.6 and 1.95.7 - The vulnerability was already addressed by Solana and a safe and updated version of the library was released. - In addition, npm removed the affected versions so their download is no longer possible. - The attack appears to only affect projects that updated the library within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 2, 2024. If this library is used in your organization we recommend verifying that these compromised versions are not in use. The team is actively searching for evidence of exploitations of this vulnerability in our customers’ environments.In case of identification of impacted customers, they will be notified directly. Please don’t hesitate to contact us for further assistance or any relevant questions. Sincerely, Team AXON

2. resolved Dec 04, 2024, 02:06 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused hunting efforts, looking for indicators of compromise. Relevant hits that require your attention will be mentioned in the AXON report. Sincerely, Team AXON

Read the full incident report →

Started Nov 17, 2024, 10:49 AM UTC· resolved Nov 19, 2024, 02:30 PM UTC

1. investigating Nov 17, 2024, 10:49 AM UTC

   Dear customers, Team AXON is aware of an ongoing Adversary-in-the-Middle (AiTM) campaign, targeting Microsoft 365 user accounts, using Axios infrastructure. This infrastructure provides the threat actor with the capability of intercepting HTTP traffic, to steal the credentials and/or session tokens of victim users. Users that authenticate using MFA are also vulnerable to this kind of attack. A threat-focused threat-hunting related to this campaign is now on-going. In case of any significant finding that requires your attention, we’ll of course reach out. An AXON report will be available for all of our AXON customers as soon as the Rapid Response efforts are concluded. Please don’t hesitate to contact us in case of any questions. Sincerely, Team AXON.

2. resolved Nov 19, 2024, 02:30 PM UTC

   Dear Customers, An Axon report on the Adversary-in-the-Middle (AiTM) campaign was released. The report includes: Indicators of Compromise (IOCs) Threat-hunting queries Insights into relevant hits If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team AXON

Read the full incident report →

Started Nov 07, 2024, 09:53 AM UTC· resolved Nov 07, 2024, 05:54 PM UTC

1. investigating Nov 07, 2024, 09:53 AM UTC

   Team Axon is aware of a vulnerability that affected Okta and would have allowed threat actors, under certain conditions, to authenticate without supplying a password. The vulnerability was already addressed and patched by Okta, according to Okta, it was exploitable between July 23rd, 2024 to October 30th, 2024 and required the following pre-conditions for an account to be vulnerable: - Okta AD/LDAP delegated authentication is used - MFA is not applied - The username is 52 characters or longer - The user previously authenticated creating a cache of the authentication - The cache was used first, which can occur if the AD/LDAP agent was down or cannot be reached, for example, due to high network traffic The team is actively searching for evidence of exploitations of this vulnerability in our customers’ environments.In case of identification of impacted customers, they will be notified directly. Please don’t hesitate to contact us for further assistance or any relevant questions. Sincerely, Team Axon

2. resolved Nov 07, 2024, 05:54 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused hunting efforts, looking for suspicious logins. Relevant hits that require your attention will be mentioned in the AXON report. Additionally, we have published two new queries for identifying users with usernames above 52 characters, and a threat hunting query for suspicious logins. These queries are available on Axon's GitHub: -Users with username above 52 characters: https://github.com/axon-git/rapid-response/blob/main/okta-auth-bypass/long_usernames_visibility.sql -Suspicous Logons of usernames above 52 characters: https://github.com/axon-git/rapid-response/blob/main/okta-auth-bypass/okta_long_usernames_logons_without_mfa.sql Axon reports have also been published for Team Axon customers, including the updated list of deliverables. Sincerely, Team Axon.

Read the full incident report →

Started Oct 31, 2024, 07:50 PM UTC· resolved Nov 03, 2024, 08:44 PM UTC

1. investigating Oct 31, 2024, 07:50 PM UTC

   Dear customers, Team AXON discovered an on-going campaign, dubbed “VEILDrive”, in which a threat actor uses a combination of common and sophisticated techniques including phishing via Microsoft Teams, lure victims to provide him with initial access using remote management tools, following by additional TTPs, including a deployment of a unique malware that abuses Microsoft services for command and control purposes. A threat-focused threat-hunting related to this campaign is now on-going. In case of any significant finding that requires your attention, we’ll of course reach out. An AXON report will be available for all of our AXON customers as soon as the Rapid Response efforts are concluded. Please don’t hesitate to contact us in case of any questions. Sincerely, Team AXON.

2. resolved Nov 03, 2024, 08:44 PM UTC

   Dear customers, Following our latest update, we continued with the threat-focused hunting efforts, looking for potential hits using the TTPs and IOCs we had from the research conducted for VEILDrive threat campaign. AXON reports have been published for AXON customers, including more details regarding the campaign and recommended action items. Relevant hits that require your attention will be mentioned in the AXON report. It's also important to mention that a detailed blog post, that includes in-depth technical details about the campaign will be published on Hunters' website in the coming days. Please feel free to reach out in case of any follow-up questions. Sincerely, Team Axon.

Read the full incident report →

Started Oct 29, 2024, 09:27 AM UTC· resolved Oct 31, 2024, 12:53 PM UTC

1. investigating Oct 29, 2024, 09:27 AM UTC

   Team Axon has identified an ongoing infostealer campaign, known by multiple names including "KcozApp,", "RoxiApp", during a recent threat-hunting campaign. This infostealer functions as a loader, distributing malware such as browser hijackers, data stealers, and keyloggers. Once installed, it can compromise system integrity and data security. Customers affected have already been notified, and we are closely monitoring this activity. Team Axon will continue to assess and analyze the campaign, and we will provide further updates, including potential deliverables, as findings emerge. For any immediate concerns or further assistance, please reach out to us. Sincerely, Team Axon

2. resolved Oct 31, 2024, 12:53 PM UTC

   RoxiApp is an emerging threat campaign that initially appears as adware but has significant potential to operate as an info-stealer. Masked as a legitimate application, it is delivered through a ZIP file containing an MSI installer. Once installed, RoxiApp uses a heavily obfuscated PowerShell script to bypass detection and deploy a malicious browser extension. When RoxiApp successfully executes, it leverages PowerShell to install a browser extension with potent info-stealing capabilities, including - Screen Capture - Clipboard Manipulation - Accesses and alters clipboard data. - Browsing Activity Tracking - Monitors user browsing behavior, with the potential for further data exfiltration. The use of PowerShell to create the malicious browser extension demonstrates RoxiApp’s advanced capabilities and highlights its potential to escalate into a highly critical threat. IOCs And hunting queries are available in the Axon reports

Read the full incident report →