How North Korea's Fake Company Compromised Millions | 2 Minute Drill with Drex DeFord

Why It Matters

A single compromised maintainer can inject malware into software used by millions, exposing health‑care systems to data breaches and operational risk, making supply‑chain vigilance essential.

Key Takeaways

• North Korean UNCC 1069 used fake company to deceive a developer.
• They compromised Axios library, delivering malware to 100M weekly downloads.
• Attack succeeded via social engineering, bypassing multi‑factor authentication.
• One trusted maintainer became a supply‑chain entry point.
• Map privileged accounts and verify requests to prevent similar breaches.

Summary

The video details a supply‑chain attack in early 2026 where North Korea’s threat group UNCC 1069 created a fake company to trick Axios maintainer Jason Samon into installing a malicious file.

The actors spent two weeks building a realistic Slack workspace, LinkedIn profiles and a Teams call, then delivered a remote‑access Trojan. Within hours, two poisoned versions of the Axios library were published on the MPM repository, exposing roughly 135 endpoints during a three‑hour window and potentially reaching the library’s 100 million weekly downloads.

Despite Jason’s two‑factor authentication, the breach succeeded because the attack was purely social engineering, not a technical exploit. Researchers noted the compromised releases were quickly pulled and detections added, but the incident underscores how a single trusted account can become a vector for massive distribution.

Enterprises, especially in health care, must inventory privileged developers, enforce strict code‑signing and request verification, and treat supply‑chain trust as a critical security perimeter rather than relying solely on perimeter defenses.

Original Description

North Korean threat actors didn't breach a firewall. They built a fake company. UNC1069 spent two weeks constructing a convincing Slack workspace, fake team members, and LinkedIn profiles to earn the trust of Jason Seaman -- lead maintainer of Axios, a JavaScript library downloaded over 100 million times a week. One Teams call. One file. Within hours, malicious code was live and reaching health systems everywhere. The attack skipped the $50M security stack entirely and went straight to the human. Drex breaks down what happened, why it worked, and asks the question every health IT leader needs to answer: have you mapped who in your organization carries that kind of leverage?

Remember, Stay a Little Paranoid

Linkedin: https://www.linkedin.com/company/ThisWeekHealth

Twitter: https://twitter.com/thisweekhealth

Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer - https://www.alexslemonade.org/mypage/3173454