UNC6426 is a supply chain threat actor known for targeting AWS environments via GitHub token theft.
Analyst brief
UNC6426 is a threat actor associated with a supply chain compromise. They primarily target developers and AWS cloud environments via GitHub token theft. Their TTPs include abusing GitHub-to-AWS OIDC trust, using the open-source tool Nord Stream for CI/CD reconnaissance, and exfiltrating data from AWS S3 buckets. Defenders should monitor for GitHub PAT leaks, enforce least privilege on cloud roles, and scrutinize CI/CD pipeline configurations for similar OIDC abuse.
UNC6426
unknown
UNC6426 exploited a supply chain compromise of the nx npm package to steal a developer's GitHub Personal Access Token and gain access to a victim's cloud environment. They abused the GitHub-to-AWS OpenID Connect trust to create a new administrator role, leveraging overly permissive permissions associated with the compromised GitHub-Actions-CloudFormation role. Using the legitimate open-source tool Nord Stream, UNC6426 conducted reconnaissance and extracted secrets from CI/CD environments, leading to the exfiltration of files from AWS S3 buckets and data destruction. The actor escalated to full AWS administrator permissions in under 72 hours.