Sapphire Sleet Supply Chain and Social Engineering

Sapphire Sleet (also known as BlueNoroff) is a North Korean threat actor motivated by financial gain through cryptocurrency theft. Since 2020, they have focused on financial services, blockchain, and venture capital, but recently expanded their operations into large-scale npm supply chain compromises affecting ecosystems like Axios and Mastra.

The actor's primary methodology involves establishing rapport with targets on professional platforms like LinkedIn before shifting to Telegram to deliver malicious links. In 2026, they significantly matured their tradecraft by leveraging "ClickFix" techniques and malicious npm dependencies (e.g., easy-day-js) to deploy platform-specific RATs across Windows, macOS, and Linux. The impact of these operations is high, directly threatening developer environments and CI/CD pipelines to facilitate credential theft and lateral movement.