North Korean hackers are responsible for a new open source software (OSS) supply chain attack targeting the Rust ecosystem, cybersecurity firm Wiz reports.
The attack occurred on August 20 and involved one of the most popular Rust crates, arrayref, an array-conversion utility with over 245 million downloads, found in approximately 75% of environments where Rust is used.
The malicious package version, [email protected], was pushed to crates.io from its legitimate maintainer’s account. Roughly 20 minutes later, poisoned versions of internment and append-only-vec, two crates from the same owner, were also released.
These packages, as well as attacker-owned crates (aovine, arone, aronenao, tinymember), were referencing the same malicious dependency, [email protected], which impersonated the legitimate proc-macro2 package.
Within the dependency, the threat actor hid a malicious file, build.rs, designed to fetch a platform-specific second-stage binary over TLS, after disabling certificate validation.
The Rust Security Response Team removed the malicious packages roughly 86 minutes later, confirming the compromise: “a new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.”
Shortly after, the Rust security team said all malicious packages have been removed, and the clean iterations have been restored. The team found no evidence of actual usage of the malicious crates.
“We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them,” Rust’s security team said.
StepSecurity’s analysis of the attack shows that the threat actor planned each step with precision, creating typosquatted versions of proc-macro2 and an impersonating account right before the poisoned arrayref release was published.
According to Wiz, the North Korean threat actor Sapphire Sleet, which mounted the Axios and Mastra NPM supply chain attacks in April and June, was likely responsible for the arrayref incident, based on substantial infrastructure overlaps.
The arrayref payloads beacon to an endpoint used in the Mastra attack, command-and-control (C&C) traffic was recorded to an IP used in the Axios campaign, and the same IP range of Hostwinds LLC infrastructure was used in all three incidents.
Related: Fortune 500 Companies Hit in Azure Data Theft Campaign
Related: Trivy, Not LiteLLM Behind the 2,500 Org Compromise
Related: Hackers Target Zimbra Servers in Active Exploitation Campaign
Related: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
