Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet) — Threadlinqs Intelligence
As of 2026-08-21, Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet) is a critical-severity supply chain threat attributed to APT38 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-2085 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Updated: 2026-08-21 · revalidated 1× · latest source
Attribution: APT38 · North Korea · ESPIONAGE
On August 20, 2026, three legitimate Rust crates (arrayref, internment, append-only-vec) maintained by David Roundy (droundy) were compromised via a typosquat dependency proc-macro1 impersonating
On August 20, 2026, a coordinated supply chain attack compromised three legitimate Rust crates maintained by David Roundy (crates.io user droundy): arrayref (a widely used macro for safe array referencing, ~152M+ downloads), internment (an interning library), and append-only-vec (an append-only vector). The attacker gained access to the maintainer's crates.io account through compromised credentials, then published malicious versions (arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9) that each added a single typosquat dependency: proc-macro1, impersonating the legitimate and widely used proc-macro2 crate (154M+ downloads). The attacker also yanked legitimate versions of arrayref (0.3.5-0.3.9) to steer dependency resolution toward the malicious release.
The typosquat proc-macro1 crate was published by a forged identity (dtolney, with the email rchaitm@gmail.com) and replicated the genuine proc-macro2 source code as camouflage. Its Cargo.toml metadata forged the author as David Tolnay and linked to a non-existent GitHub repository. The malicious logic resided entirely in build.rs, which executes automatically during cargo build — no import or explicit function call by the application is needed. The build.rs reconstructs C2 addresses from Base64-encoded fragments, disables TLS certificate validation via a custom AcceptAll ServerCertVerifier, detects the victim's OS and architecture, and downloads a platform-specific stage-2 payload from 23.254.165.112:9089. On Unix systems it writes /tmp/rust-setup, sets executable permissions, and spawns it detached. On Windows it writes %TEMP%\rust-setup.ps1 plus a VBS launcher and executes via wscript.exe with hidden PowerShell ExecutionPolicy Bypass and CREATE_NO_WINDOW, using std::mem::forget to escape Cargo's job object.
The stage-2 backdoor (analyzed across four platform-specific variants — Linux x86-64, Windows x86-64, macOS x86-64, macOS ARM64) shares a common protocol, configuration structure, AES-128-GCM encryption (hardcoded key 'i am botking'), and RSA-2048 command authentication. It performs host profiling (username, hostname, OS, architecture, privilege level, installed applications), inventories Chromium-based browsers (Chrome, Brave, Edge) for visited login origins and extension identifiers, and establishes C2 beaconing via HTTPS POST to /49890878. The backdoor supports four commands: kill, minicfg (reconfigure C2/beacon interval), startup (install persistence), and runscript (download and execute arbitrary scripts). Persistence mechanisms are OS-specific: Windows HKCU Run key, Linux systemd user service, macOS LaunchAgent. When primary C2 is unreachable, the implant falls back to a Domain Generation Algorithm producing ten deterministic .com domains rotated every 5 days.
Wiz Research attributes the attack to North Korean state-sponsored group Sapphire Sleet (also tracked as UNC1069 by Google/Mandiant and BlueNoroff) based on multiple infrastructure overlaps: the C2 endpoint /49890878 was previously used in the Mastra npm supply chain campaign (attributed by Microsoft to DPRK/Sapphire Sleet); the SSL certificate issuer WIN-A6QF8AHPQH1\Administrator matches infrastructure from the Mastra operation; C2 traffic to 23.254.167.216 appears in Google Cloud Threat Intelligence's analysis of UNC1069's axios npm attack (April 2026); and the entire operation uses the 23.254.164.0/23 Hostwinds LLC IP range consistent with DPRK-linked activity. This campaign is part of a broader DPRK effort (Contagious Interview) that has targeted five ecosystems — npm, PyPI, Go Modules, crates.io, and Packagist — with 1,700+ malicious packages since January 2025.
Socket.dev's AI Scanner independently detected proc-macro1 as malicious at 07:29:50 UTC on the day of the attack. Nextron Systems separately reported the activity to the Rust Security Response Team, which deleted all malicious versions within approximately two hours (86-107 minutes online per affected crate), locked the compromised dround
Weaknesses (CWE)
CWE-494, CWE-829, CWE-1104, CWE-506, CWE-912
Target sectors: software-development, technology, open-source, devops, cloud
Target regions: Global
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
8 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195.001, T1078, T1204.002, T1059.004, T1059.001, T1547.001, T1543.001, T1543.002, T1027, T1140
