Google Threat Intelligence Group
Google/Mandiant's threat-intelligence division; attributed the Axios supply-chain attack to North Korea's UNC1069.
Google Threat Intelligence Group named North Korea-linked UNC1069 on 5 May 2026 as the CREW behind the Axios compromise, in which a phished maintainer account pushed the WAVESHAPER.V2 backdoor into two npm releases with 183 million combined weekly downloads.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why did it take GTIG 35 days to find WAVESHAPER.V2 inside one of npm's most-downloaded packages?
Timeline for Google Threat Intelligence Group
Mentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesNamed BREEZE COMET and asserted overlap with two other tracked clusters
Cybersecurity: Threats and Defences: Google renames a Brazilian payment-fraud actorTracked and attributed UNC6780 as the operator behind the GitHub breach
Cybersecurity: Threats and Defences: GitHub's own code cloned via add-onMentioned in: UNC6780 takes Cisco AI Defense source code
Cybersecurity: Threats and DefencesMentioned in: GTIG names the first LLM-written working zero-day
Cybersecurity: Threats and DefencesBackground
Google Threat Intelligence Group is the threat-research division of Google Cloud. It absorbed Mandiant, which Google bought in 2022 for about $5.4bn, and with it one of the longest-running nation-state tracking programmes in the industry. GTIG publishes attribution of state and criminal campaigns, and Google's own services give it supply-chain and phishing telemetry that most security vendors lack.
GTIG keeps Mandiant's naming scheme. A UNC label marks an uncategorised cluster that has not met the bar for a numbered APT designation, so UNC1069 is assessed as North Korea-nexus without a confirmed APT number. When GTIG folds clusters together, names change: on 1 September 2026 it renamed UNC5669 as BREEZE COMET, a financially motivated group attacking Brazil's Pix, STR and Boleto payment systems with a Rust tunnelling tool called COBALTSPIN.
GTIG also reports on attackers' use of AI. Its 11 May 2026 report documented the first confirmed criminal use of a large language model to write a working zero-day exploit, a Python bypass of two-factor login caught before mass use, and named state-linked clusters using Gemini in their operations.
GTIG unmasked the Axios attackers
GTIG and Mandiant reported on 5 May 2026 that UNC1069 added a malicious dependency, plain-crypto-js, to Axios versions 1.14.1 and 0.30.4 between 00:21 and 03:20 UTC on 31 March. The implant, WAVESHAPER.V2, runs on Windows, macOS and Linux. Disclosure came 35 days after the injection, coordinated with npm maintainers and Microsoft's GitHub.
GTIG widened the count on 11 May, confirming that @shadanai/openclaw and @qqbrowser/openclaw-qbot had pulled in the same backdoor through automatic dependency resolution during that three-hour window. Developers WHO never installed Axios directly were exposed. Two days after the attribution, on 7 May, the Center for Strategic and International Studies published a paper urging a working US-South Korea cyber response.
GTIG followed one crew across three breaches
On 11 May 2026 GTIG named UNC6780, which calls itself TeamPCP, as the cluster that cloned more than 300 private Cisco GitHub repositories, including source code for Cisco AI Defense and Cisco AI Assistant. GTIG traced the access to developer credentials stolen through the Trivy scanner compromise, CVE-2026-33634.
GTIG tied the same cluster to the LiteLLM intrusion, in which UNC6780 exploited the SQL injection CVE-2026-42208 within 36 hours of CISA listing it on 8 May; BerriAI, LiteLLM's commercial parent, was also hit. A week later GitHub confirmed that roughly 3,800 internal repositories were cloned through a poisoned Nx Console extension, and GTIG's tracking put that breach under UNC6780 too.
