HexStrike
HEXSTRIKE is a toolkit/malware framework identified in a targeted npm supply-chain attack reported by Breakglass Intelligence. It was linked to nine malicious npm packages impersonating Strapi CMS plugins, published on 2026-04-03 by the npm account umarbek1233. The packages used postinstall hooks to execute a Node.js payload that deployed a multi-phase C2 agent. Reported capabilities include theft of environment variables, .env files, Strapi configuration, database credentials, JWT secrets, Redis data, Docker secrets, Kubernetes service account tokens, SSH/private keys, PEM files, and cryptocurrency wallet-related files. The malware beaconed over plain HTTP to 144.31.107.231:9999, polled the C2 every five seconds for up to 60 rounds, accepted arbitrary shell commands from cmd.txt, and was associated with a reverse shell script connecting to 144.31.107.231:4444. An exposed directory on 144.31.107.231:8888 contained 52 toolkit files including C2 code, credential-harvesting tools, persistence scripts, lateral movement utilities, and exploitation tooling. Recovered components included Strapi SSTI exploit scripts for CVE-2023-22621, account-takeover tooling that triggered password resets and read reset tokens from PostgreSQL, Elasticsearch TLS interception tooling, and an OverlayFS-based container escape exploit described as a CVE-2023-0386 variant. The operation was assessed as a focused, financially motivated intrusion, with Guardarian, an Estonian cryptocurrency exchange, identified as the confirmed primary victim. Reported stolen data included Guardarian PostgreSQL credentials, JWT secrets, Redis connection details, API integration details, a live API key, and employee email addresses used in credential-stuffing scripts. The toolkit name HEXSTRIKE was derived from the leaked path /opt/hexstrike_ssrf/.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Toolkit name : "HEXSTRIKE" (from path /opt/hexstrike_ssrf/ ) ... published 9 malicious npm packages impersonating Strapi CMS plugins ... deploy a multi-phase C2 agent via postinstall that steals environment variables, database credentials, JWT secrets, API keys, Redis data, Docker secrets, Kubernetes tokens, SSH keys, cryptocurrency wallets, and establishes a persistent reverse shell with 5-second polling.
Toolkit name : "HEXSTRIKE" (from path /opt/hexstrike_ssrf/ ) ... published 9 malicious npm packages impersonating Strapi CMS plugins ... deploy a multi-phase C2 agent via postinstall that steals environment variables, database credentials, JWT secrets, API keys, Redis data, Docker secrets, Kubernetes tokens, SSH keys, cryptocurrency wallets, and establishes a persistent reverse shell with 5-second polling.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
threat actors are using large language models to... automate reconnaissance against exposed assets... Hexstrike, paired with a temporal knowledge graph called Graphiti... lets the agent maintain persistent state across the attack surface and decide for itself when to pivot between reconnaissance tools
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
5 techniques
Credential Access
[Phase 9] Private key/PEM/wallet/secret file discovery + exfil
[Phase 3] .env file theft (11 hardcoded paths + find /) [Phase 4] Full environment variable dump (env command)
Discovery
3 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Command and Control
1 technique
Command and Control
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-phase npm-delivered C2 agent and attacker toolkit used in a targeted supply-chain compromise. It executes via postinstall hooks in malicious Strapi-themed npm packages, performs extensive credential and secret theft, maps networks, accesses Redis/Docker/Kubernetes data, supports reverse shell access, and enables follow-on exploitation and lateral movement.
HexStrike is an AI-powered tool used to automate the analysis and exploitation of known vulnerabilities, accelerating the exploitation process for attackers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.