CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.6
Command and Control2 detection rules
Standing S0222
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques2Bottom 7%
7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.
Tactics2Bottom 12%
12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13.5med26th pct
26th percentile · 74% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique1medBottom 5%
5th percentile · 95% of 825 ATT&CK software entries have more atomic tests per technique.
Data comps / technique6med54% tie · 11 values
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique2medTop 9%
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 2 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process. (...)
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. (...)
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. (...)
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.