eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Axios npm Packages Compromised in a Supply Chain Attack
Bottom Line: The Democratic People's Republic of Korea (DPRK) linked threat actor UNC1069 compromised Axios npm packages to deploy variants of a Remote Access Trojan (RAT) on Windows, MacOS, and Linux systems.
On March 31st, 2026, threat actors published two Axios npm package versions 1.14.1 and 0.30.4, injected with a malicious JSON dependency package. Installation of these packages resulted in deployment of a cross-platform Remote Access Trojan, WAVESHAPER.V2, on the affected hosts. Security researchers have attributed this attack to a Democratic People's Republic of Korea (DPRK)- linked threat actor tracked as UNC1069.
Axios is a widely used HTTP client commonly implemented in frontend frameworks, backend services, and applications; it has approximately 100 million weekly downloads. Security researchers determined that the threat actors initially compromised the credentials of the lead Axios maintainer. On March 30th, malicious JSON dependency, a typo squatted version of the legitimate crypto-js library, was published from a different attacker account. Following this, on March 31st, two Axios npm packages embedded with malicious dependency, were published from the compromised account.
The injected JSON dependency is designed to execute a post-install script as a part of the Axios package installation process and launch a dropper on the host. The dropper performs Operating System (OS) checks and communicates with the Command-and-Control (C2) server to deploy a platform-specific RAT. Once the RAT was deployed, the dropper removed itself and replaced the malicious JSON package with a decoy version.
Google Threat Intelligence Group and Elastic Security Labs reported that the RAT was an updated version of a macOS and Linux backdoor, named WAVESHAPER, that was observed in a malware delivery campaign by North Korean threat actor UNC1069. WAVESHAPER.V2 can perform directory enumeration, establish persistence on Windows systems, inject binary payloads, and execute remote commands. The RATs capabilities remained consistent across all the OSs but varied in how it was executed; in memory for Windows systems and launched directly on disk for MacOS and Linux ones. The dropper deployed a PowerShell-based RAT on Windows, a Mach-O binary payload on MacOS, and a Python-based RAT on the Linux systems.
The malicious Axios npm packages were removed from the npm registry within approximately three hours of publication. As of March 31st, npm replaced the malicious JSON dependency with a security-holder stub; attempt to install any version of the dependency now returns a security notice.
eSentire Threat Intelligence Analysis:
This supply chain attack is significant, as Axios is leveraged heavily in multiple projects as a dependency. The environments where Axios versions 1.14.1 or 0.30.4 were installed, should consider their systems compromised, unless verified. Organizations should ensure the malicious packages are removed, the environment is reverted to its known safe state, and all associated credentials are rotated.
The attack is classified as “a textbook example of dependency poisoning through maintainer account hijack” in a Endor Labs report. The threat actor sophistication was further demonstrated by a cross-platform RAT, capable of establishing persistence, executing remote commands, and exfiltrating data. Use of the RAT in this attack amplifies its impact as it enables the exfiltration of sensitive credentials, which may subsequently be sold to other threat actors, facilitating further attacks. Given that UNC1069 operates with financial motivations, it is probable that the stolen data will be leveraged to achieve the group’s stated objectives. Attribution to UNC1069 (aka STARDUST CHOLLIMA, Sapphire Sleet, BlueNoroff) is further supported by reports from CrowdStrike and Microsoft. The RAT observed in the attack is identified as ZshBucket by CrowdStike researchers. While no technical details were provided, it is possible that both WAVESAHPER.V2 and variants of ZshBucket are the same payloads.
With Axios supply chain attack, threat actors continue to abuse the supply chain ecosystem. Organizations should ensure that environments are pinned to secure versions of packages and dependencies to avoid any accidental updates. Disabling post install scripts, if possible, can prevent malicious scripts from being executed. All credentials including npm tokens, AWS access keys, SSH private keys, CI/CD secrets, and environment variables must be regularly rotated. Robust Endpoint Detection and Response (EDR) solutions can identify and contain malicious payloads.
The eSentire Threat Intelligence team has published a security advisory addressing the Axios Supply Chain attack on March 31st, 2026. The team also observed incidents associated to the attack across the customer base and the impacted organizations have been alerted. Known malicious infrastructure has been added to eSentire's Global Block List and Indicators of Compromise (IoCs) have been added to eSentire's Threat Intelligence Platform (TIP).
F5 BIG-IP APM Flaw CVE-2025-53521 Exploited in the Wild
Bottom Line: A critical vulnerability in F5 BIG-IP Access Policy Manager (APM), tracked as CVE-2025-53521, is being actively exploited in the wild. Initially disclosed in October 2025 as a Denial-of-Service (DoS) issue, the flaw was reclassified in March 2026 as an unauthenticated Remote Code Execution (RCE) vulnerability following confirmed exploitation activity.
CVE-2025-53521 is a critical vulnerability affecting F5 BIG-IP Access Policy Manager (APM) that is currently being exploited in the wild. On March 27th and 28th, 2026, F5 confirmed that the vulnerability, which had originally been disclosed in October 2025 as a Denial-of-Service (DoS) issue, had been reassessed and reclassified as an unauthenticated Remote Code Execution (RCE) flaw based on observed real-world exploitation activity. The vulnerability now carries a CVSS score of 9.3. F5 stated in it's advisory that active exploitation has included the deployment of in-memory webshells.
CVE-2025-53521 is an unauthenticated RCE vulnerability that affects F5 BIG-IP APM systems when an access policy is configured on a virtual server. Under these conditions, specially crafted malicious network traffic can allow an attacker to execute arbitrary commands within the context of the apmd process. The vulnerability impacts multiple supported versions of BIG-IP APM, specifically versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, and 17.5.0 through 17.5.1. The security impact on End-of-Technical Support (EoTS) versions has not been fully evaluated, and organizations operating legacy deployments may therefore face elevated risk. F5 has released several Indicators of Compromise (IoCs) to assist with detection and investigation.
In response to confirmed exploitation, CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog on March 27th, 2026.
eSentire Threat Intelligence Analysis:
F5's APM is a secure, flexible, and high-performance access management proxy solution that offers unified global access controls for users, devices, applications, and APIs. Successful exploitation of CVE-2025-53521 could enable attackers to establish persistent access, deploy additional malware, harvest credentials, and pivot laterally into internal enterprise environments. Because BIG-IP APM devices typically occupy a privileged position within network architectures and handle sensitive authentication and access control functions, compromise may result in widespread downstream impact.
It is important to note that the flaw was initially assigned a CVSS score of 7.5, and its subsequent addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog underscores the elevated risk and confirms active, real‑world exploitation that necessitates urgent remediation. Federal Civilian Executive Branch agencies are required to apply mitigations by March 30th, 2026. F5 has released fixes in versions 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3 respectively. Organizations are strongly advised to upgrade all affected BIG-IP APM instances to the fixed versions released by F5 immediately. Security teams should review system logs, file integrity, and network traffic associated with BIG-IP devices. If exploitation or suspicious activity is detected, organizations should assume compromise, follow F5’s incident response guidance, rotate potentially exposed credentials, and initiate formal incident response procedures. In the longer term, organizations should prioritize the replacement or upgrade of End-of-Support (EoS) devices and ensure that BIG-IP systems are incorporated into continuous vulnerability management and monitoring programs.
The eSentire Threat Intelligence team published a security advisory addressing CVE-2025-53521 on March 30th, 2026. eSentire's Managed Vulnerability Service (MVS) has plugins to identify devices vulnerable to CVE-2025-53521. eSentire's Threat Response Unit (TRU) has developed threat detections within MDR for Network and MDR for Log. The TRU team is actively tracking the topic for additional details and new detection opportunities.
Exploitation of Critical Citrix Vulnerability Identified
Bottom Line: Ongoing exploitation for a critical memory overread vulnerability within Citrix NetScaler ADC and NetScaler Gateway products has been identified, with reports highlighting its similarities to both CitrixBleed and CitrixBleed2.
On March 28th, 2026, watchTowr Labs published a technical report on CVE-2026-3055 (CVSS: 9.3), a critical memory overread vulnerability within Citrix NetScaler ADC and NetScaler Gateway products. The vulnerability is an insufficient input validation flaw within the outlined products, which can lead to the leaking of sensitive information. CVE-2026-3055 was initially disclosed by Citrix on March 23rd, 2026, where they confirmed that the vulnerability only impacted devices that were configured as SAML Identity Providers (IdP), and that patches were available to address the flaw.
Within their analysis of CVE-2026-3055, watchTowr Labs demonstrates how the vulnerability can be exploited, leading to sensitive information “leaking out of the appliance”. watchTowr Labs highlights how “suspiciously similar” this vulnerability is to CVE-2023-4966 and CVE-2025-5777, which have been dubbed CitrixBleed and CitrixBleed2, respectively. On March 29th, watchTowr Labs published a follow up to their report, where they provide additional information regarding CVE-2026-3055, including that it has been “assigned to at least two memory overread vulnerabilities” impacting different components of NetScaler ADC and NetScaler Gateway. Exploitation of the flaw is also demonstrated again, showing how exploitation led to obtaining an authenticated administrative session ID, granting administrator access to the target NetScaler appliance.
Finally, watchTowr Labs claimed that in-the-wild exploitation of CVE-2026-3055 had been observed within their honeypot environment, from as early as March 27th, suggesting that threat actors were attempting to exploit the flaw within attacks. On March 30th, CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that exploitation has been identified, and providing Federal Civilian Executive Branch (FCEB) agencies a deadline of April 2nd, 2026, to apply relevant patches.
eSentire Threat Intelligence Analysis:
What makes CVE-2026-3055 notable is the similarities identified between the flaw and both CitrixBleed and CitrixBleed2. Regarding CitrixBleed, mass exploitation of the vulnerability was observed shortly after its disclosure in October 2023. CitrixBleed was also identified to have been leveraged in ransomware attacks by the groups LockBit and Play. CitrixBleed2, which was initially disclosed in June 2025, was also widely adopted within attacks following its disclosure. However, in November 2025, Amazon reported that the vulnerability was initially exploited as a zero-day by an unnamed APT group. Regarding CVE-2026-3055, Defused has outlined a timeline in reported attacks, noting mass exploitation by March 29th. Defused highlights that the payload structure within the outlined attacks matches the “watchTowr proof of concept”, demonstrating that the release of technical information and Proof-of-Concept (PoC) exploit code can lead to widespread exploitation.
At the time of writing, there are currently no reports providing information regarding attacks involving successful exploitation of CVE-2026-3055. Although CISA added the flaw to its KEV catalog, no information regarding the observed attacks was provided, so it is unclear if they are basing this assessment on the same attempts observed by Defused and watchTowr Labs, or if different attacks have been identified. The short deadline for remediation provided by CISA also suggests that the organization considers the flaw to be critical for FECB agencies, which could potentially be due to the vulnerability's similarities to CitrixBleed. Given the critical nature of CVE-2026-3055, the history of similar vulnerabilities within Citrix NetScaler ADC and NetScaler Gateway products, and reports of ongoing exploitation, impacted organizations should ensure that relevant security patches are applied as soon as possible.
eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2026-3055, while eSentire MDR for Network has detections in place to monitor for exploitation attempts. eSentire's Threat Response Unit (TRU) has identified exploitation attempts against CVE-2026-3055 impacting our customer base and has added attacker IP addresses to eSentire’s Global Block List. eSentire's Threat Intelligence team continues to track this vulnerability for further information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
