{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The use of malicious npm packages to target developers bypasses traditional perimeter defenses and exploits the trust inherent in the open-source ecosystem; a negative result confirms the estate is not currently impacted by this specific campaign."
      },
      "name": "Apex Accelerator npm supply-chain delivery",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1195",
        "attack.t1071.001",
        "attack.t1204.002",
        "command and control",
        "defense evasion",
        "execution",
        "exfiltration",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "auditing-the-auditor-unmasking-apex-accelerator",
        "index": 1,
        "title": "Auditing the auditor: Unmasking Apex Accelerator",
        "total": 2
      },
      "related": [
        {
          "hunt": "apex-accelerator-powershell-vbs-staging",
          "reason": "This hunt identifies the delivery; the follow-on hunt examines the PowerShell and VBScript staging identified in the research.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple detection rule might fire on the specific domains, but this hunt use a generalized behavioral search for any binary execution from node_modules directories, pivoting between inventory and process telemetry to build a complete chain of intent.",
      "coverage": [
        {
          "stage": "supply-chain-npm-install",
          "steps": [
            "detect-npm-packages"
          ],
          "status": "covered"
        },
        {
          "stage": "launcher-binary-execution",
          "steps": [
            "detect-launcher-binaries"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-command-retrieval",
          "steps": [
            "detect-verification-callback"
          ],
          "status": "covered"
        },
        {
          "stage": "defense-evasion-registry-defender",
          "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "powershell-vbs-staging",
          "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "payload-malware-deployment",
          "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "exfiltration-over-telegram",
          "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Malicious npm Package Installation",
            "slug": "supply-chain-npm-install",
            "tactic": "initial-access",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "@apexacc/cli",
              "@apexacc/audit",
              "apex.cjs",
              "audit.cjs"
            ]
          },
          {
            "name": "Platform-Specific Binary Launch",
            "slug": "launcher-binary-execution",
            "tactic": "execution",
            "techniques": [
              "T1204.002"
            ],
            "observables": [
              "apex-windows-x64.exe",
              "apex-audit-windows-x64.exe",
              "apex-darwin-arm64",
              "apex-audit-darwin-arm64",
              "apex-bootstrap.ts",
              "main.ts"
            ]
          },
          {
            "name": "Verification Server Callback",
            "slug": "c2-command-retrieval",
            "tactic": "command-and-control",
            "techniques": [
              "T1071.001"
            ],
            "observables": [
              "vrf.apexaccs.org",
              "apex-verify-darwin",
              "apex-audit-verify-darwin",
              "POST /api/v1/vrf"
            ]
          },
          {
            "name": "Windows Defense Impairment",
            "slug": "defense-evasion-registry-defender",
            "tactic": "defense-evasion",
            "techniques": [
              "T1562.001",
              "T1112"
            ],
            "observables": [
              "VerifiedAndReputablePolicyState",
              "Add-MpPreference -ExclusionPath %USERPROFILE%\\.apex-audit",
              "UAC elevation requests on Windows 11"
            ]
          },
          {
            "name": "Scripted Payload Staging",
            "slug": "powershell-vbs-staging",
            "tactic": "execution",
            "techniques": [
              "T1059.001",
              "T1059.003"
            ],
            "observables": [
              "_apex_run.vbs",
              "_audit_run.vbs",
              "_apex_run.ps1",
              "_audit_run.ps1",
              "drop.ps1",
              "WScript.Shell.Run",
              "powershell -NoProfile -ExecutionPolicy Bypass"
            ]
          },
          {
            "name": "Info-Stealer and Backdoor Execution",
            "slug": "payload-malware-deployment",
            "tactic": "persistence",
            "techniques": [
              "T1005"
            ],
            "observables": [
              "bludness.exe",
              "install.exe",
              "exegis.exe",
              "updater_loader.exe",
              "CloudSyncD",
              "pi_natives.win32-x64-baseline.node"
            ]
          },
          {
            "name": "Data Exfiltration",
            "slug": "exfiltration-over-telegram",
            "tactic": "exfiltration",
            "techniques": [
              "T1041",
              "T1567"
            ],
            "observables": [
              "Telegram API endpoints",
              "ZIP archive creation in temporary directories",
              "verify.apexfdn.xyz"
            ]
          }
        ],
        "summary": "The Apex Accelerator campaign uses malicious npm packages and a fake Web3 platform to target cryptocurrency startups with info-stealing malware. The attack chain involves a supply-chain delivery mechanism that fetches platform-specific executables (Bun/Rust) to retrieve and execute further payloads on Windows and macOS, ultimately exfiltrating data via Telegram."
      },
      "severity": "high",
      "rationale": "Focus on engineering and developer workstations where npm is in use. The software inventory scoping step narrows behavior queries to only the affected hosts, reducing telemetry cost.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary targets developer workstations by tricking users into installing malicious npm packages that masquerade as Web3 auditing tools to execute platform-specific backdoors from within the project directory.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the software inventory scoping step; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "target_packages": {
          "from": {
            "ref": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages",
            "kind": "article",
            "observed": "2026-10-12"
          },
          "type": "list[string]",
          "default": [
            "@apexacc/cli",
            "@apexacc/audit"
          ],
          "description": "Malicious npm package names identified in the research."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages",
          "name": "Auditing the auditor: Unmasking Apex Accelerator"
        }
      ],
      "blind_spots": [
        {
          "id": "inventory-visibility-gap",
          "risk": "Local npm installations might not be picked up by global inventory scanners, and the lack of installation timestamps in the inventory surface prevents temporal correlation with execution events.",
          "stage": "supply-chain-npm-install",
          "question": "whether a package was installed locally in a project directory rather than globally",
          "requires": "hb_software_inventory coverage for local node_modules"
        },
        {
          "id": "network-visibility-gap",
          "risk": "Without high-fidelity process attribution on network connections, identifying callbacks from binaries in project directories relies on endpoint telemetry that may be incomplete.",
          "stage": "c2-command-retrieval",
          "question": "whether a network flow initiated by a project-path binary is attributed correctly",
          "requires": "hb_network_connection with process path enrichment on every flow"
        }
      ]
    },
    "name": "Apex Accelerator npm supply-chain delivery",
    "description": "The adversary targets crypto start-ups by distributing backdoored npm packages. The hunt is gated on a software inventory lead to minimize telemetry costs. The hunt identifies these packages in software inventory, then fans out to examine generalized binary execution from within node_modules directories and associated network callbacks. The analyst reviews the correlated evidence to confirm the intrusion."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "auditing-the-auditor-unmasking-apex-accelerator",
          "index": 1,
          "title": "Auditing the auditor: Unmasking Apex Accelerator",
          "total": 2
        },
        "coverage": [
          {
            "stage": "supply-chain-npm-install",
            "steps": [
              "detect-npm-packages"
            ],
            "status": "covered"
          },
          {
            "stage": "launcher-binary-execution",
            "steps": [
              "detect-launcher-binaries"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-command-retrieval",
            "steps": [
              "detect-verification-callback"
            ],
            "status": "covered"
          },
          {
            "stage": "defense-evasion-registry-defender",
            "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "powershell-vbs-staging",
            "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "payload-malware-deployment",
            "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "exfiltration-over-telegram",
            "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary targets developer workstations by tricking users into installing malicious npm packages that masquerade as Web3 auditing tools to execute platform-specific backdoors from within the project directory.",
        "blind_spots": [
          {
            "id": "inventory-visibility-gap",
            "risk": "Local npm installations might not be picked up by global inventory scanners, and the lack of installation timestamps in the inventory surface prevents temporal correlation with execution events.",
            "stage": "supply-chain-npm-install",
            "question": "whether a package was installed locally in a project directory rather than globally",
            "requires": "hb_software_inventory coverage for local node_modules"
          },
          {
            "id": "network-visibility-gap",
            "risk": "Without high-fidelity process attribution on network connections, identifying callbacks from binaries in project directories relies on endpoint telemetry that may be incomplete.",
            "stage": "c2-command-retrieval",
            "question": "whether a network flow initiated by a project-path binary is attributed correctly",
            "requires": "hb_network_connection with process path enrichment on every flow"
          }
        ],
        "scoping_notes": "Focus on engineering and developer workstations where npm is in use. The software inventory scoping step narrows behavior queries to only the affected hosts, reducing telemetry cost.",
        "beyond_detection": "A simple detection rule might fire on the specific domains, but this hunt use a generalized behavioral search for any binary execution from node_modules directories, pivoting between inventory and process telemetry to build a complete chain of intent."
      }
    },
    {
      "id": "detect-npm-packages",
      "type": "query",
      "label": "Detect malicious npm packages and suspicious paths",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path, vendor_name, provider FROM hb_software_inventory WHERE (instr(',' || '{{target_packages}}' || ',', ',' || package_name || ',') > 0 OR LOWER(install_path) LIKE '%\\\\node_modules\\\\.apex%' OR LOWER(install_path) LIKE '%/node_modules/.apex%')",
        "surface": "hb_software_inventory",
        "description": "Find hosts where the malicious Apex packages or their hidden configuration directories are present. The query use the instr() pattern because the platform expands the target_packages list as a comma-joined string; this ensures exact matches for each package name within the SQLite engine.",
        "expected_signal": "Rows identify specific hosts and users that installed the malicious packages. Silence means the specific packages or suspicious .apex directory patterns are not present in current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Detect malicious npm packages and suspicious paths",
        "reads": [
          "device_hostname",
          "install_path",
          "package_name",
          "package_version",
          "provider",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path, vendor_name, provider FROM hb_software_inventory WHERE (instr(',' || '{{target_packages}}' || ',', ',' || package_name || ',') > 0 OR LOWER(install_path) LIKE '%\\\\node_modules\\\\.apex%' OR LOWER(install_path) LIKE '%/node_modules/.apex%')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows identify specific hosts and users that installed the malicious packages. Silence means the specific packages or suspicious .apex directory patterns are not present in current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "assess-lead",
      "type": "analytic",
      "label": "Evaluate npm installation lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "detect-npm-packages"
        ],
        "objective": "Decide if the identified hosts show evidence of the malicious Apex npm packages or suspicious local project configurations that requires further behavioral analysis.",
        "description": "Decide if the findings in the software inventory warrant an expensive investigation into process and network telemetry.",
        "max_iterations": 3,
        "expected_signal": "A verdict for each host with a malicious package installation.",
        "success_criteria": "A verdict of suspicious or benign per host."
      },
      "parents": [
        {
          "id": "detect-npm-packages"
        }
      ]
    },
    {
      "id": "gate-on-lead",
      "type": "checkpoint",
      "label": "Gate for behavioral queries",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-lead verdict is suspicious for at least one host",
        "condition": "the assess-lead verdict is suspicious for at least one host",
        "blind_spot": "inventory-visibility-gap",
        "confidence": "high",
        "description": "Stop the hunt if no malicious packages were found, preventing expensive queries across the whole estate.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-lead"
        }
      ]
    },
    {
      "id": "detect-launcher-binaries",
      "type": "query",
      "label": "Generalized binary execution from node_modules",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, COUNT(*) as runs, MIN(time) as first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\node_modules\\\\%' OR LOWER(process_path) LIKE '%/node_modules/%') AND (LOWER(process_path) LIKE '%.exe' OR LOWER(process_path) LIKE '%.node' OR on_disk = 0 OR (on_disk = 1 AND process_name NOT LIKE '%.%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_path, process_cmd_line, user_name",
        "surface": "hb_process_activity",
        "description": "Identify any executable binary (PE or Mach-O) launched from within a node_modules directory tree. This generalized search captures renamed loaders or supporting components.",
        "expected_signal": "An executable seen on very few machines launched from a project dependency directory. Fleet-wide presence would suggest a legitimate developer tool."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Generalized binary execution from node_modules",
        "reads": [
          "device_hostname",
          "on_disk",
          "process_cmd_line",
          "process_name",
          "process_path",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, COUNT(*) as runs, MIN(time) as first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\node_modules\\\\%' OR LOWER(process_path) LIKE '%/node_modules/%') AND (LOWER(process_path) LIKE '%.exe' OR LOWER(process_path) LIKE '%.node' OR on_disk = 0 OR (on_disk = 1 AND process_name NOT LIKE '%.%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_path, process_cmd_line, user_name",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "An executable seen on very few machines launched from a project dependency directory. Fleet-wide presence would suggest a legitimate developer tool.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "detect-verification-callback",
      "type": "query",
      "label": "Network activity from node_modules processes",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as connections, MIN(time) as first_seen FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%\\\\node_modules\\\\%' OR LOWER(process_path) LIKE '%/node_modules/%') AND disposition = 'Allowed' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port",
        "surface": "hb_network_connection",
        "description": "Identify external network connections initiated by processes running from node_modules. This effectively pivots from the execution leads to find callbacks without relying on a static domain list.",
        "expected_signal": "Network connections to external IPs from binaries located in node_modules project trees."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Network activity from node_modules processes",
        "reads": [
          "device_hostname",
          "disposition",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "process_path",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as connections, MIN(time) as first_seen FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%\\\\node_modules\\\\%' OR LOWER(process_path) LIKE '%/node_modules/%') AND disposition = 'Allowed' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port",
        "silence": "not_evidence_of_absence",
        "expected": "Network connections to external IPs from binaries located in node_modules project trees.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "triage-findings",
      "type": "analytic",
      "label": "Triage supply-chain activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "assess-lead",
          "detect-launcher-binaries",
          "detect-verification-callback"
        ],
        "objective": "Evaluate whether the installation of suspicious packages led to binary execution from node_modules and associated C2 communication, indicating a successful supply-chain intrusion.",
        "description": "Correlate the package installation leads with generalized binary execution and network callbacks into a single verdict per host.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence verdict citing specific processes and network requests.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host."
      },
      "parents": [
        {
          "id": "detect-launcher-binaries",
          "kind": "merge"
        },
        {
          "id": "detect-verification-callback",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-triage",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-findings verdict is malicious for at least one host",
        "condition": "the triage-findings verdict is malicious for at least one host",
        "blind_spot": "network-visibility-gap",
        "confidence": "high",
        "description": "Escalate malicious findings to containment or route suspicious hits for human review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-findings"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop further command execution and exfiltration by isolating the affected host.",
        "instructions": "Isolate the host and preserve process memory for the loader binaries and any child shells.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-triage",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst forensic review",
      "config": {
        "assignee": "analyst",
        "description": "Review findings and prepare for incident response.",
        "instructions": "Confirm the presence of the npm package and investigate the child processes of the identified loaders for shell execution. Review any HTTP activity from these processes to identify the specific C2 server and fetched commands."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "default"
        },
        {
          "id": "gate-on-lead",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-triage",
          "branch": "default"
        },
        {
          "id": "route-on-triage",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record the results and confirm the absence of these specific packages.",
        "instructions": "If no hits were found, record that the estate shows no evidence of the Apex Accelerator npm packages or suspicious binary execution from project directories within the lookback window."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-triage",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}