Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor — Threadlinqs Intelligence
As of 2026-08-20, Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor is a critical-severity supply chain threat attributed to APT38 (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-2086 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: APT38 · North Korea (DPRK) · FINANCIAL
On August 20, 2026, the popular Rust crate arrayref (present in 35%+ of all environments) and two sibling crates (internment, append-only-vec) were hijacked via compromised maintainer credentials and
On August 20, 2026, at approximately 07:15 UTC, an attacker using the crates.io impersonation account 'dtolney' published malicious version 0.3.10 of the legitimate arrayref crate. The legitimate maintainer (droundy) had their machine or credentials compromised — the crate source code was not directly altered, but a single dependency line was injected into Cargo.toml. Within minutes, the same attacker published compromised versions of internment (0.8.7 at 07:34 UTC) and append-only-vec (0.1.9 at 07:37 UTC). The legitimate maintainer's account was subsequently locked as a precaution.
The injected dependency 'proc-macro1' is a typosquat of the legitimate and widely used proc-macro2 crate (154M+ total downloads). This was the first dependency added to arrayref in its ten-year history. When any Rust project depending on the compromised crate executes cargo build, proc-macro1's build.rs runs automatically at compile time. The build script reconstructs a C2 URL from Base64-obfuscated fragments pointing to a Hostwinds VPS at 23.254.165.112:9089, disables TLS certificate validation via a custom AcceptAll verifier, detects the victim's OS and architecture, downloads a platform-specific stage-2 payload, writes it to disk (/tmp/rust-setup on Unix or %TEMP%\rust-setup.ps1 on Windows), and executes it. Critically, the build script uses std::mem::forget(child) to escape Cargo's job object, ensuring the backdoor continues running after the build exits with code 0. The crate otherwise functions normally, making detection difficult.
The stage-2 implant — retrieved by Wiz Research via Google Threat Intelligence — is a full-featured cross-platform backdoor. It beacons to C2 via HTTPS POST to the /49890878 endpoint, exfiltrating host information and stolen credentials as Base64-encoded JSON. It enumerates saved logins from Chrome, Brave, and Edge browser SQLite databases (noting the queries enumerate saved logins but do not retrieve encrypted credentials). Persistence is achieved through Registry Run keys (Windows), LaunchAgents (macOS), or systemd user services (Linux). On Linux, post-infection artifacts include the directories $HOME/.config/AzureKits and $HOME/.config/ServiceKit with executables MonoService and MonoXpc. The implant supports four C2 commands: kill (terminate), minicfg (reconfigure C2 and beacon interval), startup (install persistence), and runscript (download and execute arbitrary PowerShell or shell scripts, synchronously or in background). If the primary C2 becomes unreachable, a Domain Generation Algorithm (DGA) generates 10 algorithmic .com domains every 5 days as fallback. All configuration is encrypted with AES-128-GCM using the hardcoded key 'i am botking', and commands are authenticated via an embedded RSA-2048 private key.
Attribution to North Korea is well-substantiated. The beacon path /49890878 was previously used in the Mastra npm supply chain campaign, attributed by Microsoft with high confidence to Sapphire Sleet (a DPRK state actor under the Reconnaissance General Bureau / Lab 110). The SSL certificate issuer WIN-A6QF8AHPQH1\Administrator@WIN-A6QF8AHPQH1 matches infrastructure on IP 23.254.167.13 used in the same Mastra campaign. A victim-reported C2 address 23.254.167.216 appears in Google Cloud Threat Intelligence's analysis of UNC1069's axios npm attack (March 2026), which Mandiant attributes to North Korea. Both campaigns share the same Hostwinds LLC range 23.254.164.0/23 (AS54290, Seattle). The actor further participates in the broader 'Contagious Interview' cross-ecosystem supply chain operation, which has published over 1,700 malicious packages across npm, PyPI, crates.io, Go Modules, and Packagist since January 2025.
The Rust Security Response Team was alerted by researchers at Nextron Systems. The team deleted all malicious crate versions and locked the maintainer's account. Exposure windows ranged from 86 minutes (arrayref) to 107 minutes (append-only-vec). Despite the rapid response, arrayref's per
Weaknesses (CWE)
CWE-494: Download of Code Without Integrity Check, CWE-506: Embedded Malicious Code, CWE-1104: Use of Unmaintained Third Party Components
Target sectors: technology, software-development, blockchain, cryptocurrency, finance
Target regions: Global
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
13 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.001, T1195.002, T1204.002, T1059.001, T1059.004, T1547.001, T1543.001, T1543.002, T1027
