🕵️ Sapphire Sleet

The items that name it 8

• Tracking AI adoption in North Korean threat actor tradecraft
  articleas threat actors2026-10-29It is written here as Sapphire Sleet (North Korean; accelerating stage; likely used AI in the August 2026 Rust software compromise, with malware using dynamic .NET compilation during post-exploitation).

  North Korean; accelerating stage; likely used AI in the August 2026 Rust software compromise, with malware using dynamic .NET compilation during post-exploitation

• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas classification.key entities2026-10-07
• Shai-Hulud was the best thing to happen to supply chain security
  articleas threat actors2026-08-24

  North Korea state-linked actor; on Mar 31, 2026 compromised an Axios maintainer account and published two backdoored versions 39 minutes apart, each injecting a fake dependency that downloaded a cross-platform remote access trojan; malicious packages live for three hours.

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeupas classification.key entities2026-08-20
• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeupas classification.key entities2026-08-20
• The OpenSourceMalware Show #15
  talkas threat actors2026-07-31

  DPRK-linked threat actor Amazon attributes to the September 2025 compromise of the debug and chalk npm packages and the typo-crypto package (first seen March 2025).

• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
  writeupas threat actors2026-06-16It is written here as Sapphire Sleet (BlueNoroff).

  BlueNoroff

• Threat Actor Targets Crypto Organizations | Wiz Blog
  writeupas classification.key entities2026-05-27