DPRK-linked supply chain campaigns (ChainDrop, PolinRider) use Web3 blockchain C2 to steal cloud credentials from developer and CI/CD environments
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …