IOC Radar
TLP:WHITE5 IOCs

Amazon identifies North Korean hacker group behind open-source supply chain attacks

AS
AWS Security
Published July 29, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAPT38INFRASTRUCTURE216.74.123.126npmjs.storeCAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(2)
Capability
Victim

5W+H Threat Analysis

Analysis unavailable

Indicators of Compromise

Indicators of Compromise5

TypeIndicatorConfidenceScoreFirst Seen
IP216.74.123.126
intel-blognetworksupply-chain
High
58
Jul 30, 26
SHA122d200f8670dbdb3e253a90eee5098477c95c23d
aptddosespionage
High
82
Jun 2, 26
SHA25624604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f
file-hashintel-blogsupply-chain
Medium
53
Jul 30, 26
Domainnpmjs.store
intel-blognetworksupply-chain
High
58
Jul 30, 26
SHA2562014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73
file-hashintel-blogsupply-chain
Medium
53
Jul 30, 26

IOC Relationship Graph

IOC Relationship Graph5 total IOCs
IPSHA1SHA256Domain
SHA2562IP1SHA11Domain1Actors1REPORTAmazon identifies North KoAPT38
scroll to zoom · drag to pan · click IOC to open