{
	"id": "787fec9a-952c-4e6f-a9a6-af27a6412bfe",
	"created_at": "2026-05-06T02:03:41.134695Z",
	"updated_at": "2026-05-06T02:03:52.772254Z",
	"deleted_at": null,
	"sha1_hash": "078a390b27afdc1f57607375f7549fa40a1d2467",
	"title": "Tracking \u0026 Detecting GhostSocks Malware",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 781003,
	"plain_text": "Tracking \u0026 Detecting GhostSocks Malware\r\nBy Isabel Evans\r\nPublished: 2026-03-26 · Archived: 2026-05-06 02:01:00 UTC\r\nSoftware supply-chain attacks in 2026\r\nSoftware supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than\r\nrelying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering\r\nenvironments: package managers, CI/CD automation, developer systems, and even the security tools organizations\r\ninherently trust.\r\nThese incidents are not isolated cases of poisoned code. They reflect a structural shift toward abusing trusted\r\nautomation and identity at ecosystem scale, where compromise propagates through systems designed for speed,\r\nnot scrutiny. Ephemeral build runners, regardless of provider, represent high‑trust, low‑visibility execution zones.\r\nThe Axios compromise and the cascading Trivy campaign illustrate how quickly this abuse can move once\r\nattacker activity enters build and delivery workflows. This blog provides an overview of the latest supply chain\r\nand security tool incidents with Darktrace telemetry and defensive actions to improve organizations defensive\r\ncyber posture.\r\n1. Why the Axios Compromise Scaled\r\nOn 31 March 2026, attackers hijacked the npm account of Axios’s lead maintainer, publishing malicious versions\r\n1.14.1 and 0.30.4 that silently pulled in a malicious dependency, plain‑crypto‑js@4.2.1. Axios is a popular HTTP\r\nclient for node.js and  processes 100 million weekly downloads and appears in around 80% of cloud and\r\napplication environments, making this a high‑leverage breach [1].\r\nThe attack chain was simple yet effective:\r\nA compromised maintainer account enabled legitimate‑looking malicious releases.\r\nThe poisoned dependency executed Remote Access Trojans (RATs) across Linux, macOS and Windows\r\nsystems.\r\nThe malware beaconed to a remote command-and-control (C2) server every 60 seconds in a loop, awaiting\r\nfurther instructions.\r\nThe installer self‑cleaned by deleting malicious artifacts.\r\nAll of this matters because a single maintainer compromise was enough to project attacker access into thousands\r\nof trusted production environments without exploiting a single vulnerability.\r\nA view from Darktrace\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 1 of 6\n\nMultiple cases linked with the Axios compromise were identified across Darktrace’s customer base in March\r\n2026, across both Darktrace / NETWORK and Darktrace / CLOUD deployments.\r\nIn one Darktrace / CLOUD deployment, an Azure Cloud Asset was observed establishing new external HTTP\r\nconnectivity to the IP 142.11.206[.]73 on port 8000. Darktrace deemed this activity as highly anomalous for the\r\ndevice based on several factors, including the rarity of the endpoint across the network and the unusual\r\ncombination of protocol and port for this asset. As a result, the triggering the \"Anomalous Connection /\r\nApplication Protocol on Uncommon Port\" model was triggered in Darktrace / CLOUD. Detection was driven by\r\nenvironmental context rather than a known indicator at the time. Subsequent reporting later classified the\r\ndestination as malicious in relation to the Axios supply‑chain compromise, reinforcing the gap that often exists\r\nbetween initial attacker activity and the availability of actionable intelligence. [5]\r\nAdditionally, shortly before this C2 connection, the device was observed communicating with various endpoints\r\nassociated with the NPM package manager, further reinforcing the association with this attack.\r\nFigure 1: Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port\r\n8000.  \r\nWithin Axios cases observed within Darktrace / NETWORK customer environments, activity generally focused\r\non the use of newly observed cURL user agents in outbound connections to the C2 URL sfrclak[.]com/6202033,\r\nalongside the download of malicious files.\r\nIn other cases, Darktrace / NETWORK customers with Microsoft Defender for Endpoint integration received\r\nalerts flagging newly observed system executables and process launches associated with C2 communication.\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 2 of 6\n\nFigure 2: A Security Integration Alert from Microsoft Defender for Endpoint associated with the\r\nAxios supply chain attack.\r\n2. Why Trivy bypassed security tooling trust\r\nBetween late February and March 22, 2026, the threat group TeamPCP leveraged credentials from a previous\r\nincident to insert malicious artifacts across Trivy’s distribution ecosystem, including its CI automation, release\r\nbinaries, Visual Studio Code extensions, and Docker container images [2].\r\nWhile public reporting has emphasized GitHub Actions, Darktrace telemetry highlights attacker execution within\r\nCI/CD runner environments, including ephemeral build runners. These execution contexts are typically granted\r\nbroad trust and limited visibility, allowing malicious activity within build automation to blend into expected\r\noperational workflows, regardless of provider.\r\nThis was a coordinated multi‑phase attack:\r\n75 of 76  of trivy-action tags and all setup‑trivy tags were force‑pushed to deliver a malicious payload.\r\nA malicious binary (v0.69.4) was distributed across all major distribution channels.\r\nDeveloper machines were compromised, receiving a persistent backdoor and a self-propagating worm.\r\nSecrets were exfiltrated at scale, including SSH keys, Kuberenetes tokens, database passwords, and cloud\r\ncredentials across Amazon Web Service (AWS), Azure, and Google Cloud Platform (GCP).\r\nWithin Darktrace’s customer base, an AWS EC2 instance monitored by Darktrace / CLOUD  appeared to have\r\nbeen impacted by the Trivy attack. On March 19, the device was seen connecting to the attacker-controlled C2\r\nserver scan[.]aquasecurtiy[.]org (45.148.10[.]212), triggering the model 'Anomalous Server Activity / Outgoing\r\nfrom Server’ in Darktrace / CLOUD.\r\nDespite this limited historical context, Darktrace assessed this activity as suspicious due to the rarity of the\r\ndestination endpoint across the wider deployment. This resulted in the triggering of a model alert and the\r\ngeneration of a Cyber AI Analyst incident to further analyze and correlate the attack activity.\r\nTeamPCP’s continued abused of GitHub Actions against security and IT tooling has also been observed more\r\nrecently in Darktrace’s customer base. On April 22, an AWS asset was seen connecting to the C2 endpoint\r\naudit.checkmarx[.]cx (94.154.172[.]43). The timing of this activity suggests a potential link to a malicious\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 3 of 6\n\nBitwarden package distributed by the threat actor, which was only available for a short timeframe on April 22. [4]\r\n[3]\r\nFigure 3: A model alert flagging unusual external connectivity from the AWS asset, as seen in Darktrace / CLOUD\r\n.\r\nWhile the Trivy activity originated within build automation, the underlying failure mode mirrors later intrusions\r\nobserved via management tooling. In both cases, attackers leveraged platforms designed for scale and trust to\r\nexecute actions that blended into normal operational noise until downstream effects became visible.\r\nQuest KACE: Legacy Risk, Real Impact\r\nThe Quest KACE System Management Appliance (SMA) incident reinforces that software risk is not confined to\r\ndevelopment pipelines alone. High‑trust infrastructure and management platforms are increasingly leveraged by\r\nadversaries when left unpatched or exposed to the internet.\r\nThroughout March 2026, attackers exploited CVE 2025-32975 to authentication on outdated, internet-facing\r\nKACE appliances, gaining administrative control and pushing remote payloads into enterprise environments.\r\nOrganizations still running pre-patch versions effectively handed adversaries a turnkey foothold, reaffirming a\r\nsimple strategic truth: legacy management systems are now part of the supply-chain threat surface, and treating\r\nthem as “low-risk utilities” is no longer defensible [3].\r\nWithin the Darktrace customer base, a potential case was identified in mid-March involving an internet-facing\r\nserver that exhibited the use of a new user agent alongside unusual file downloads and unexpected external\r\nconnectivity. Darktrace identified the device downloading file downloads from \"216.126.225[.]156/x\",\r\n\"216.126.225[.]156/ct.py\" and \"216.126.225[.]156/n\", using the user agents, \"curl/8.5.0\" \u0026 \"Python-urllib/3.9\".\r\nThe timeframe and IoCs observed point towards likely exploitation of CVE‑2025‑32975. As with earlier incidents,\r\nthe activity became visible through deviations in expected system behavior rather than through advance\r\nknowledge of exploitation or attacker infrastructure. The delay between observed exploitation and its addition to\r\nthe Known Exploited Vulnerabilities (KEV) catalogue underscores a recurring failure: retrospective validation\r\ncannot keep pace with adversaries operating at automation speed.\r\nThe strategic pattern: Ecosystem‑scale adversaries\r\nThe Axios and Trivy compromises are not anomalies; they are signals of a structural shift in the threat landscape.\r\nIn this post-trust era, the compromise of a single maintainer, repository token, or CI/CD tag can produce large-scale blast radiuses with downstream victims numbering in the thousands. Attackers are no longer just exploiting\r\nvulnerabilities; they are exploiting infrastructure privileges, developer trust relationships, and automated build\r\nsystems that the industry has generally under secured.\r\nSupply‑chain compromise should now be treated as an assumed breach scenario, not a specialized threat class,\r\nparticularly across build, integration, and management infrastructure. Organizations must operate under the\r\nassumption that compromise will occur within trusted software and automation layers, not solely at the network\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 4 of 6\n\nedge or user endpoint. Defenders should therefore expect compromise to emerge from trusted automation layers\r\nbefore it is labelled, validated, or widely understood.\r\nThe future of supply‑chain defense lies in continuous behavioral visibility, autonomous detection across developer\r\nand build environments, and real‑time anomaly identification.\r\nAs AI increasingly shapes software development and security operations, defenders must assume adversaries will\r\nalso operate with AI in the loop. The defensive edge will come not from predicting specific compromises, but\r\nfrom continuously interrogating behavior across environments humans can no longer feasibly monitor at scale.\r\nCredit to Nathaniel Jones (VP, Security \u0026 AI Strategy, FCISCO), Emma Foulger (Global Threat Research\r\nOperations Lead), Justin Torres (Senior Cyber Analyst), Tara Gould (Malware Research Lead)\r\nEdited by Ryan Traill (Content Manager)\r\nAppendices\r\nReferences:\r\n1)         https://www.infosecurity-magazine.com/news/hackers-hijack-axios-npm-package/\r\n2)         https://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.html\r\n3)         https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html\r\n4)         https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-\r\nsupply-chain-attack\r\n5)         https://socket.dev/blog/axios-npm-package-compromised?trk=public_post_comment-text\r\nIoCs\r\n- 142.11.206[.]73 – IP Address – Axios supply chain C2\r\n- sfrclak[.]com – Hostname – Axios supply chain C2\r\n- hxxp://sfrclak[.]com:8000/6202033 - URI – Axios supply chain payload\r\n- 45.148.10[.]212 – IP Address – Trivy supply chain C2\r\n- scan.aquasecurtiy[.]org – Hostname - Trivy supply chain C2\r\n- 94.154.172[.]43 – IP Address - Checkmarx/Bitwarden supply chain C2\r\n- audit.checkmarx[.]cx – Hostname - Checkmarx/Bitwarder supply chain C2\r\n- 216.126.225[.]156 – IP Address – Quest KACE exploitation C2\r\n- 216.126.225[.]156/32 - URI – Possible Quest KACE exploitation payload\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 5 of 6\n\n- 216.126.225[.]156/ct.py - URI - Possible Quest KACE exploitation payload\r\n- 216.126.225[.]156/n - URI - Possible Quest KACE exploitation payload\r\n- 216.126.225[.]156/x - URI - Possible Quest KACE exploitation payload\r\n- e1ec76a0e1f48901566d53828c34b5dc – MD5 - Possible Quest KACE exploitation payload\r\n- d3beab2e2252a13d5689e9911c2b2b2fc3a41086 – SHA1 - Possible Quest KACE exploitation payload\r\n- ab6677fcbbb1ff4a22cc3e7355e1c36768ba30bbf5cce36f4ec7ae99f850e6c5 – SHA256 - Possible Quest KACE\r\nexploitation payload\r\n- 83b7a106a5e810a1781e62b278909396 – MD5 - Possible Quest KACE exploitation payload\r\n- deb4b5841eea43cb8c5777ee33ee09bf294a670d – SHA1 - Possible Quest KACE exploitation payload\r\n- b1b2f1e36dcaa36bc587fda1ddc3cbb8e04c3df5f1e3f1341c9d2ec0b0b0ffaf – SHA256 - Possible Quest KACE\r\nexploitation payload\r\nDarktrace Model Detections\r\nAnomalous Connection / Application Protocol on Uncommon Port\r\nAnomalous Server Activity / Outgoing from Server\r\nAnomalous Connection / New User Agent to IP Without Hostname\r\nAnomalous File / EXE from Rare External Location\r\nAnomalous File / Script from Rare External Location\r\nAnomalous Server Activity / New User Agent from Internet Facing System\r\nAnomalous Server Activity / Rare External from Server\r\nAntigena / Network / External Threat / Antigena Suspicious File Block\r\nAntigena / Network / External Threat / Antigena Suspicious File Pattern of Life Block\r\nDevice / New User Agent\r\nDevice / Internet Facing Device with High Priority Alert\r\nAnomalous File / New User Agent Followed By Numeric File Download\r\nSource: https://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nhttps://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.darktrace.com/blog/phantom-footprints-tracking-ghostsocks-malware"
	],
	"report_names": [
		"phantom-footprints-tracking-ghostsocks-malware"
	],
	"threat_actors": [],
	"ts_created_at": 1778033021,
	"ts_updated_at": 1778033032,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/078a390b27afdc1f57607375f7549fa40a1d2467.pdf",
		"text": "https://archive.orkl.eu/078a390b27afdc1f57607375f7549fa40a1d2467.txt",
		"img": "https://archive.orkl.eu/078a390b27afdc1f57607375f7549fa40a1d2467.jpg"
	}
}