BlueNoroff

☆ pin

MITRE G0162Also known as Sapphire Sleet, STARDUST CHOLLIMA, UNC1069, SapphireSleet, Stardust Chollima, ClickFake Interview, Alluring Pisces, CageyChameleon, CryptoCore, TA444, COPERNICIUM

Reports

First seen

Jun 18, 2025

Last seen

Aug 3, 2026

Motivation

Financial, Espionage

Targeting

Sectors

Technology ×7 Financial Services ×2

Victim regions

United States ×1

Top ATT&CK techniques

T1195 Supply Chain Compromise ×6T1195.001 Supply Chain Compromise: Compromise Software Dependencies ×6T1566.002 Phishing: Spearphishing Link ×5T1071.001 Application Layer Protocol: Web Protocols ×4T1598 Social Engineering ×4T1041 Exfiltration Over C2 Channel ×4T1566 Phishing ×4T1547 Boot or Logon Autostart Execution ×4T1110 Brute Force ×3T1005 Data from Local System ×3T1078 Valid Accounts ×3T1082 System Information Discovery ×3

Indicators

hash_sha256 ×15domain ×12filename ×11url ×6hash_sha1 ×3ip_v4 ×3hash_md5 ×2email ×2registry_key ×1cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-31431 (exploited)

Recent reports

Medium

BlueNoroff

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

North Korean hackers behind major open-source supply chain attacks, Amazon says

Amazon Attributes npm Package Hijacks (debug, chalk, typo-crypto) to North Korea's Sapphire Sleet

North Korea-linked group used npm package compromises as testing ground before axios attack

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

Microsoft attributes Mastra AI npm supply chain attack to North Korean Sapphire Sleet

North Korean Hackers Using Developer Tools to Deliver Malware

CrowdStrike 2026 Technology Threat Landscape Report: China's Ambitions Fuel Attacks

CrowdStrike 2026 Financial Services Threat Landscape Report Overview

Tradecraft Tuesday Recap: axios npm Supply Chain Compromise

Supply Chain Compromise of axios npm Package—Cross-Platform RAT Delivered

Inside the BlueNoroff Web3 macOS Intrusion Analysis