REF8801
0 reportsIntel LibraryREF8801
Intrusion set tracked by Elastic Security Labs, posing as a Web3 venture accelerator (Apex Accelerator / Apex Arena, Apex Foundation) to target cryptocurrency start-ups and founders. Lures offer investment, free AI credits and security audits, and lead victims to install npm packages (@apexacc/cli, @apexacc/audit) that fetch platform-specific payloads: the CloudSyncD backdoor on macOS and a custom information stealer exfiltrating through Telegram on Windows. The packages also repackage a legitimate coding agent to route LLM traffic through attacker infrastructure and register an attacker-controlled MCP server in the victim's agent configuration. Earlier npm packages from the same operation were reported by SafeDep in July 2026. Elastic makes no state or group attribution.
Vendor aliases (1)
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | REF8801 |
MITRE ATT&CK techniques (0)
No techniques mapped yet.
Indicators of compromise
No IOCs extracted yet from reports naming this actor.
Report timeline
Every report in the Global Intel Library that names REF8801, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Threat feed IOCs (0)
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to REF8801. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Public research & publications (2)
Open-source reports about this actor collected from MISP Galaxy.