Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time — Threadlinqs Intelligence
As of 2026-08-20, Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time is a critical-severity supply chain threat attributed to Sapphire Sleet (BlueNoroff (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-2089 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Sapphire Sleet (BlueNoroff · North Korea · ESPIONAGE
On August 20, 2026, attackers compromised the crates.io maintainer account droundy (David Roundy) and published malicious versions of three widely-used Rust crates — arrayref (245M+ lifetime
This sophisticated supply-chain attack targeted the Rust open-source ecosystem by compromising the crates.io maintainer account droundy (David Roundy, registered October 2009, user 2402). The attacker first created an impersonation account — dtolney (crates.io id 438608) — typosquatting prominent Rust developer David Tolnay (dtolnay), author of the ubiquitous proc-macro2 crate (154M+ downloads). At 01:55 UTC on August 20, the attacker published proc-macro1@1.0.106 as a clean decoy — a genuine renamed copy of proc-macro2 — to establish credibility. At 07:11 UTC, the weaponized proc-macro1@1.0.107 was published, containing a malicious build.rs script with build dependencies (ureq, rustls, base64) that acted as a download-and-execute dropper.
At 07:15 UTC, the compromised droundy account published arrayref@0.3.10, adding proc-macro1 as the crate's first-ever runtime dependency in its ten-year history. Critically, the attacker simultaneously yanked legitimate versions 0.3.5 through 0.3.9 in a scripted burst (each yank 2.6-5.6 seconds apart), leaving the malicious 0.3.10 as the only version Cargo would not warn about. Internment@0.8.7 followed at 07:34 UTC and append-only-vec@0.1.9 at 07:37 UTC. The library source code of all three crates was left completely unchanged — only the Cargo.toml dependency was added, making the infection invisible to casual inspection.
During any cargo build, cargo check, or cargo test that resolved the poisoned dependency, the proc-macro1 build.rs would: (1) concatenate base64-encoded URL fragments at runtime to reconstruct the payload host (https://23.254.165.112:9089/) and C2 address (23.254.165.112:443); (2) install a custom AcceptAll TLS certificate verifier that unconditionally accepts self-signed or mismatched certificates; (3) select a platform-specific payload binary (rust-crate_0.1.0 through _0.4.0) for Linux x86-64, Windows x86-64, macOS x86-64, or macOS ARM64; (4) download the payload over HTTPS; (5) on Unix, write to /tmp/rust-setup, chmod +x, and spawn detached with no stdin/stdout/stderr via std::mem::forget(child) — a step explicitly commented in the source as escaping Cargo's job object; (6) on Windows, write a PowerShell script to %TEMP%\rust-setup.ps1, launch it hidden via a VBScript wrapper (rust-setup-launch.vbs) under wscript.exe with CREATE_NO_WINDOW, then abandon the child handle. The build then completed normally, producing no visible errors.
The second-stage payload is a feature-rich Rust-based backdoor supporting x86-64 Linux, x86-64 Windows, x86-64 macOS, and ARM64 macOS. It beacons to the C2 via HTTPS POST to endpoint /49890878, exfiltrating host info (hostname, OS type, OS version, architecture, platform version, installed applications) and stolen credentials as base64-encoded JSON. The payload targets Chromium-based browsers (Google Chrome, Brave, Microsoft Edge) by querying SQLite login databases for origin URLs and usernames, and also accesses Local Extension Settings where cryptocurrency wallet extensions store data. Configuration is encrypted with AES-128-GCM using the hardcoded null-padded key 'i am botking', with a secondary key 'test' for minicfg parameters. Commands are authenticated via an embedded RSA-2048 private key. The payload supports four commands: kill (terminate), minicfg (reconfigure C2 address and beacon interval), startup (install persistence), and runscript (download and execute arbitrary PowerShell or shell scripts, synchronously or in background). If primary C2 is unreachable, the backdoor generates 10 algorithmic .com domains every 5 days via a Domain Generation Algorithm (DGA). Persistence is established via Registry Run key (Windows), LaunchAgent at Library/LaunchAgents with a RunAtLoad /bin/zsh -c command (macOS), and a systemd user service (Linux). On Linux, the payload creates directories $HOME/.config/AzureKits and $HOME/.config/ServiceKit, dropping executables named MonoService and MonoXpc.
Researcher jhobern reported the attack to the Ru
Weaknesses (CWE)
CWE-494, CWE-1104, CWE-912
Target sectors: technology, software-development, blockchain, cryptocurrency, financial-services, cloud-computing, it - security
Target regions: Global
Related threats
- Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack
- Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)
- Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor
- Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and Typo-Crypto npm Packages in Supply-Chain Campaign
- Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)
- BlockBlasters Steam Game Supply-Chain Compromise Delivers StealC Infostealer and StimBlaster Backdoor via Malicious Patch (Build 19799326)
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
10 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1585, T1195, T1204, T1059, T1547, T1543, T1027, T1036, T1564, T1685
