Digital manipulation, fake pickup requests, and identity hijacking are on the rise. NMFTA’s Cybersecurity Cargo Crime Reduction Framework is here to help you to understanding how modern cargo theft works. Don't wait for a costly breach, download to take immediate action and safeguard your assets.

PLUS: Download the free Vendor Risk Assessment Framework and get a practical checklist and scoring model to evaluate, onboard, and monitor third-party vendors.

Table of Contents

Cyberthreat Analysis

• Widespread Supply Chain Compromise Impacting NPM Ecosystem
• Threat Spotlight: Speed, Scale, and Stealth: How Axios Powers Automated Phishing
• Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

Industry News

#NMFTACyber On Demand

Widespread Supply Chain Compromise Impacting NPM Ecosystem

The Cybersecurity and Infrastructure Security Agency (CISA) released this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.

After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

Threat Spotlight: Speed, Scale, and Stealth: How Axios Powers Automated Phishing

ReliaQuest has identified an anomalous surge in stolen credentials that likely indicates mass-automated phishing activity. Their investigation points to a rapidly evolving threat: attackers exploiting the Axios user agent—a lightweight, promisebased HTTP client—to automate phishing and credentialstealing at unprecedented scale. In recent campaigns, Axios abuse was amplified through Microsoft Direct Send, a trusted email delivery method that helps phishing traffic slip past secure gateways.

• Explosive Growth Across Multiple Detections: Between June and August 2025, activity tied to Axios as a user agent surged by 241%, far exceeding the growth seen across all other flagged user agents. Out of 32 flagged user agents observed in this timeframe, Axios accounted for 24.44% of all activity. This makes Axios 10 times more common than any other user agent attackers are using. 

• Staggering Success Rates: In the most recent campaign we tracked, 70% of incidents leveraging Axios and Direct Send resulted in credentials being stolen successfully. Over the past three months, Axios-powered attacks had a 58% success rate overall, compared to just 9.3% for incidents without Axios. 

• Shifting Targets: Beginning in July 2025, this campaign initially focused on high-profile individuals, such as executives and managers in industries like finance, health care, and manufacturing. By August, it had broadened in scope to include everyday users. 

The combination of the Axios user agent with tools like Direct Send is proving to be a game-changer for attackers, yielding far higher success rates in account takeovers than traditional phishing methods, which were only seen succeeding around 9.3% of the time over the past three months. By exploiting the trusted nature of Direct Send and leveraging Axios’s lightweight, developer-friendly design, attackers are not only scaling their operations but also streamlining attack techniques to bypass traditional security defenses with alarming precision. This efficiency allows attackers to steal credentials faster, at a scale and success rate unmatched by other methods. 

Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

In late July 2025, Arctic Wolf Labs began observing a surge of intrusions involving suspicious SonicWall SSL VPN activity. Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware. Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation. This campaign has recently escalated, with new infrastructure linked to it observed as late as September 20, 2025.

SonicWall links the malicious logins observed in this campaign to CVE-2024-40766, an improper access control vulnerability identified a year ago. From this perspective, credentials would have potentially been harvested from devices vulnerable to CVE-2024-40766 and later used by threat actors—even if those same devices were patched. Threat actors in the present campaign successfully authenticated against accounts with the one-time password (OTP) MFA feature enabled.

It is worth noting that SonicWall recently disclosed an incident involving the MySonicWall cloud backup service. While SonicWall has stated the incident was not a ransomware event, the full extent of this breach may not yet be fully known. At this time, there is no evidence linking the MySonicWall cloud backup file incident to the Akira ransomware campaign described here.

With dwell times measured in hours rather than days—among the shortest we’ve recorded for ransomware—the window for effective response against this threat is exceptionally narrow. By detecting unexpected logins from a handful of hosting-related ASNs and identifying Impacket SMB activity over the network, intrusions can be disrupted at an early stage. We present our findings here to help organizations protect against this ongoing threat.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!