source_3917.pdf (11 MB)

WhoisXML API mapped DNS infrastructure from the UNC1069 compromise of the axios NPM package, which delivered the cross-platform WAVESHAPER.V2 backdoor through malicious `plain-crypto-js` post-install execution. The analysis consolidated five subdomains, seven domains, and 10 IP indicators and found traffic from potential victims to several of them. DNS and WHOIS pivots produced 1,770 additional artifacts, but only seven had confirmed prior weaponization. Confirmed campaign infrastructure and the explicitly weaponized examples are preserved separately from unverified connected-domain samples.