Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)

Key facts for Rust fake job video calls

Detection coverage for Rust fake job video calls

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2603 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Beacon to Known arrayref/Sapphire Sleet C2 Infrastructure (Hostwinds /49890878 Path)

Detects outbound network connections to the confirmed arrayref/proc-macro1 second-stage C2 IPs, the shared Hostwinds LLC 23.254.164.0/23 hosting range, or the specific port 9089 / '/49890878' beacon path that overlaps with the Microsoft-attributed Sapphire Sleet Mastra npm campaign and the Google-attributed UNC1069 axios npm campaign.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573.001, T1105
• Data sources: firewall, proxy, dns
• Severity: critical
• Confidence: high

Splunk SPL

index=firewall OR index=proxy OR index=dns sourcetype IN ("pan:traffic","cisco:asa","stream:tcp","dns")
(dest_ip IN ("23.254.165.112","23.254.167.107","23.254.167.216") OR cidrmatch("23.254.164.0/23",dest_ip))
OR (dest_port=9089 AND uri_path="/49890878")
OR (query="hwsrv-798836.hostwindsdns.com")
| eval matched_ioc=case(
    dest_ip="23.254.165.112" OR dest_ip="23.254.167.107" OR dest_ip="23.254.167.216","known-arrayref-C2",
    cidrmatch("23.254.164.0/23",dest_ip),"hostwinds-shared-range",
    uri_path="/49890878","sapphire-sleet-beacon-path",
    query="hwsrv-798836.hostwindsdns.com","hostwinds-rdns",
    true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, uri_path, matched_ioc
| where count > 3
| sort -count

Microsoft KQL

let KnownC2IPs = dynamic(["23.254.165.112","23.254.167.107","23.254.167.216"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (KnownC2IPs)
   or ipv4_is_in_range(RemoteIP, "23.254.164.0/23")
   or (RemotePort == 9089 and RemoteUrl has "/49890878")
   or RemoteUrl has "hwsrv-798836.hostwindsdns.com"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, ActionType
| order by Timestamp desc

Sigma

title: Outbound Connection to arrayref/Sapphire Sleet C2 Infrastructure (Hostwinds 23.254.164.0/23, Port 9089, Path /49890878)
id: a1d64f2b-7c3e-4b91-8d5a-3e9c1f6b2a05
status: experimental
description: Detects outbound network connections to the known arrayref/proc-macro1 second-stage C2 IPs and the shared Hostwinds LLC /23 hosting range, including the specific port 9089 / '/49890878' beacon path that overlaps with the Microsoft-attributed Sapphire Sleet Mastra npm campaign.
references:
    - https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
    - https://rustsec.org/advisories/RUSTSEC-2026-0260
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573.001
    - attack.t1105
    - attack.group.g0082
    - attack.tool.sapphire_sleet
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp|cidr: '23.254.164.0/23'
    selection_port:
        DestinationPort: 9089
    condition: selection_ip or selection_port
falsepositives:
    - Other legitimate Hostwinds LLC hosting customers sharing the same /23 (rare in combination with port 9089)
level: critical

Known false positives:

• Shared hosting neighbors on the Hostwinds /23 range unrelated to this campaign — corroborate with the /49890878 URI path or file/process IOCs before high-severity triage

Tuning notes: Prioritize alerts matching both the CIDR AND port 9089/path /49890878 combination to reduce false positives from unrelated Hostwinds tenants; the DGA fallback (KQL-003) covers cases where the actor rotates off this static infrastructure.

• 🔒 ClickFix Mid-Call Clipboard Paste-and-Run (Fake Audio Codec / Job-Interview Lure) · unlock with TL Creds
• 🔒 Browser Credential Store Accessed by rust-setup Backdoor Process · unlock with TL Creds
• 🔒 DGA Fallback and DPRK Sibling C2 Infrastructure (ntinvoicepload.dynu.net Dynamic DNS) · unlock with TL Creds
• 🔒 VBScript Launcher Executing rust-setup.ps1 Second-Stage Payload · unlock with TL Creds
• 🔒 macOS LaunchAgent or Linux Systemd User-Service File Created for rust-setup Persistence · unlock with TL Creds
• 🔒 rust-setup Backdoor Process Beaconing to Hostwinds C2 with TLS Validation Disabled · unlock with TL Creds
• 🔒 Malicious Cargo Build-Time Network Egress ([indicator]/[indicator] build.rs) · unlock with TL Creds
• 🔒 Cross-Platform Persistence for rust-setup Backdoor (Registry Run Key / LaunchAgent / Systemd) · unlock with TL Creds

Indicators of compromise for Rust fake job video calls

As of 2026-09-21, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-2603.

Sample indicators (3 of 23)

• IP address: 23.254.165[.]112
• Domain: hwsrv-798836[.]hostwindsdns[.]com
• File hash: 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

Community OSINT corroboration for Rust fake job video calls

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Rust fake job video calls works

The Rust Security Response Working Group's September 17, 2026 alert ties the campaign to the August 20, 2026 compromise of the arrayref, append-only-vec, and internment crates via a malicious proc-macro1 typosquat dependency whose build.rs deployed a credential-stealing backdoor; Wiz researchers link the C2 infrastructure to the Microsoft-attributed Sapphire Sleet/DPRK cluster behind the Mastra npm and axios npm supply-chain attacks.

On September 17, 2026, the Rust Security Response Working Group and the crates.io team (statement posted by Adam Harvey) publicly warned of an ongoing, targeted social-engineering campaign against rust-lang team members and popular crate owners. The operators set up video calls under false pretexts -- a job offer, a paid project, or a contract opportunity -- backed by newly registered, plausible-looking company identities and LinkedIn profiles. Mid-call, targets are pressured to either install a purportedly missing audio codec (a disguised malware dropper) or copy-and-paste and execute a command supplied by the caller (a ClickFix-style clipboard-hijacking technique). The Rust team explicitly attributes this attack style to North Korea, noting it has also been observed against developer communities outside the Rust ecosystem, and links the current wave to a similar campaign that targeted numerous prominent Rust developers in June 2026 (exact date not disclosed).

The alert also ties this social-engineering campaign to a concrete supply-chain compromise: on August 20, 2026, a compromised crates.io maintainer account was used to publish malicious versions of three widely used crates -- arrayref 0.3.10 (245M+ historical downloads, present in an estimated 75% of cloud environments running Rust), append-only-vec 0.1.9, and internment 0.8.7. Each added a dependency on a newly published package, proc-macro1, a typosquat of David Tolnay's legitimate proc-macro2, published from an account ('dtolney') impersonating Tolnay. proc-macro1's build.rs script ran automatically at `cargo build` time: it reconstructed a C2 address from base64-encoded fragments, disabled TLS certificate validation, downloaded a platform-specific second-stage binary (Linux/Windows/macOS x86_64 and macOS arm64), wrote it to /tmp/rust-setup or %TEMP%\rust-setup.ps1, and executed it. The second-stage backdoor beacons over HTTPS to a /49890878 endpoint, steals credentials from Chrome/Brave/Edge profiles, persists via Registry Run keys (Windows), LaunchAgents (macOS), or systemd user services (Linux), supports remote commands (kill/minicfg/startup/runscript), encrypts its configuration with AES-128-GCM, authenticates commands with RSA-2048, and falls back to a DGA producing 10 .com domains every 5 days if its hardcoded C2 is unreachable. The malicious releases were live on crates.io for only 86-107 minutes (07:15-08:41/09:25 UTC) before removal, but arrayref's popularity meant real exposure for any project or CI pipeline that compiled against it in that window. Older, safe arrayref releases (0.3.5-0.3.9) were yanked to nudge developers toward installing the malicious 0.3.10.

Wiz researchers (Rami McCarthy, Benjamin Read) attributed the arrayref infrastructure to North Korea based on infrastructure overlap rather than a formal claim: the C2 beacon path (/49890878) matches the path used in the Microsoft-attributed 'Sapphire Sleet' compromise of 140+ Mastra AI npm packages in June 2026; the arrayref and Mastra C2 hosts share an SSL certificate issuer; and both campaigns, plus a related UNC1069 (Google-attributed North Korea cluster) compromise of the axios npm package, used IP space in Hostwinds LLC's 23.254.164.0/23 range (treated as weaker, corroborating evidence since Hostwinds serves many customers). Sapphire Sleet is also tracked as BlueNoroff, STARDUST CHOLLIMA, and CageyChameleon, and is linked to the broader 'Contagious Interview' cluster -- fake-recruiter campaigns that have delivered backdoors (OtterCookie, BeaverTail, InvisibleFerret, FlexibleFerret) to npm/PyPI developers via fake coding tests, and separately, ClickFix-style fake-software-update lures (e.g., 'Zoom SDK Update.scpt') against macOS targets. A concurrent September 18, 2026 law-enforcement advisory (Australia, Germany, Japan, US) on a related North Korea-linked fake-job-interview scheme, tracked as WaterPlum, reported 30,000+ compromised devices and $10.71M in confirmed cryptocurrency losses across web/software/Web3 professionals -- illustrating the same TTP class operating at scale against the wider developer ecosystem, though the source reporting does not confirm WaterPlum and this arrayref/video-call campaign are the same operation.

No CVE was assigned to any of this activity. RustSec issued RUSTSEC-2026-0260 (arrayref) and companion advisories for append-only-vec and internment; proc-macro1 was deleted from crates.io entirely.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.001 PowerShell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1568.002 Domain Generation Algorithms; T1573.001 Symmetric Cryptography

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1566.004 Spearphishing Voice

Persistence

T1543.001 Launch Agent; T1543.002 Systemd Service; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware; T1608.001 Upload Malware

Remediation for Rust fake job video calls

Patches

• No vendor patch applicable. crates.io deleted the proc-macro1 package entirely and removed the malicious arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7 releases; upgrade to a subsequent legitimate, non-malicious release.

Immediate actions

• Treat unsolicited recruiting/contract video-call outreach to Rust maintainers as suspicious; independently verify the counterparty's company and LinkedIn presence before joining a call.
• Never install a codec, driver, or 'meeting plugin' requested mid-call, and never paste or execute a command placed on your clipboard by a call participant (ClickFix pattern).
• Audit crates.io and GitHub account security for Rust maintainers/crate owners: enable MFA, review active sessions and API tokens, and rotate credentials if compromise is suspected.
• Pin exact dependency versions via Cargo.lock and review new transitive dependencies (e.g., proc-macro1) before allowing `cargo build` to execute their build.rs.
• Block or alert on network egress to 23.254.164.0/23 (Hostwinds) and the listed C2 IPs/domain; hunt for HTTPS POST requests to a numeric path like /49890878.

Workarounds

• Allow-list build-script network access; refuse to build crates that introduce new, unreviewed proc-macro dependencies; verify maintainer/account identity changes before upgrading a dependency.

Longer-term hardening

• Adopt build isolation/sandboxing for `cargo build` (deny network egress, restrict arbitrary build.rs execution) especially in CI/CD pipelines.
• Require crates.io publishers -- especially owners of high-download-count crates -- to use hardware-token MFA and undergo periodic account security reviews.
• Deploy EDR/behavioral detection for build-time process trees (cargo/rustc spawning outbound network connections or writing to %TEMP%/ /tmp).
• Build organizational awareness of North Korea-linked 'fake job interview' recruiting lures targeting developers (Contagious Interview / Sapphire Sleet TTP family).

Affected and fixed versions

• crates.io / Rust ecosystem — arrayref
  Vulnerable versions: 0.3.10
  Fixed in: removed from registry; use a subsequent legitimate release
• crates.io / Rust ecosystem — append-only-vec
  Vulnerable versions: 0.1.9
  Fixed in: removed from registry; use a subsequent legitimate release
• crates.io / Rust ecosystem — internment
  Vulnerable versions: 0.8.7
  Fixed in: removed from registry; use a subsequent legitimate release
• crates.io / Rust ecosystem — proc-macro1 (typosquat of proc-macro2)
  Vulnerable versions: 1.0.106; 1.0.107
  Fixed in: package deleted entirely from crates.io

Timeline of Rust fake job video calls

• 2026-06-01 Rust Security Response Working Group discloses a prior video-call social-engineering campaign in June 2026 that targeted numerous prominent Rust developers using the same fake job/contract pretext (exact day not disclosed in source reporting).
• 2026-08-20 The RustSec Advisory Database publishes RUSTSEC-2026-0260 for locked-ioc-21 and companion advisories for locked-ioc-14 and locked-ioc-20.
• 2026-08-20 Malicious crate versions are removed from the crates.io index between roughly 08:03 and 08:41 UTC, with locked-ioc-19 fully deleted by 09:25 UTC -- an exposure window of 86-107 minutes.
• 2026-08-20 The compromise is reported to the crates.io security team at approximately 07:54 UTC.
• 2026-08-20 Compromised versions locked-ioc-21 0.3.10, locked-ioc-14 0.1.9, and locked-ioc-20 0.8.7 are published to crates.io at approximately 07:15 UTC via a hijacked maintainer account, each depending on the malicious locked-ioc-19; older safe locked-ioc-21 releases 0.3.5-0.3.9 are yanked to funnel users onto 0.3.10.
• 2026-08-20 Benign-looking locked-ioc-19 1.0.106 is published as a typosquat of David Tolnay's legitimate proc-macro2, followed by malicious locked-ioc-19 1.0.107 containing the build.rs payload.
• 2026-08-20 Attacker-controlled crates.io/GitHub accounts, including one impersonating Rust developer David Tolnay ('locked-ioc-22'), are created around 01:17 UTC to stage the typosquat package locked-ioc-19.
• 2026-08-21 Wiz researchers (Rami McCarthy, Benjamin Read) publish analysis linking the locked-ioc-21 C2 infrastructure (path /49890878, shared SSL issuer, Hostwinds locked-ioc-12 range) to the Microsoft-attributed Sapphire Sleet/DPRK Mastra npm campaign and the Google-attributed UNC1069 axios npm campaign.
• 2026-09-17 The Rust Security Response Working Group and crates.io team (Adam Harvey) publish 'Be alert: targeted attacks on prominent Rustaceans,' warning of an ongoing video-call campaign against rust-lang members and popular crate owners using fake missing-audio-codec installs or clipboard paste-and-run commands, and attributing the technique to North Korea.
• 2026-09-18 Australian, German, Japanese, and US law enforcement issue a joint advisory on a related North Korea-linked fake-job-interview campaign (tracked as WaterPlum), reporting 30,000+ devices compromised and $10.71M in confirmed cryptocurrency losses across web/software/crypto professionals.
• 2026-09-21 SecurityWeek reports on the Rust Security Response Working Group's alert, the source article for this threat record.

Sources cited for Rust fake job video calls

• Be alert: targeted attacks on prominent Rustaceans blog.rust-lang.org · Advisory · 2026-09-17
• RUSTSEC-2026-0260: arrayref malicious dependency advisory rustsec.org · Advisory · 2026-08-20
• RUSTSEC-2026-0260 (OSV entry) osv.dev · Advisory · 2026-08-20
• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Wiz · Research · 2026-08-21
• CSA Research Note: arrayref Rust Supply Chain DPRK Overlap labs.cloudsecurityalliance.org · Research · 2026-08-21
• Dissecting Sapphire Sleet's macOS intrusion from lure to compromise Microsoft · Vendor report · 2026-04-16
• Contagious Interview: Malware delivered through fake developer job interviews Microsoft · Vendor report · 2026-03-11
• Rust team members and popular crate owners targeted via video calls SecurityWeek · News · 2026-09-21
• Hackers poison arrayref Rust crate to push infostealer malware BleepingComputer · News · 2026-08-20
• North Korean Hackers Tied to Rust Supply Chain Attack infosecurity-magazine.com · News · 2026-08-21
• North Korea's fake job interviews infected 30,000 devices The Register · News · 2026-09-18
• Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads The Hacker News · News · 2026-08-21

Threats related to Rust fake job video calls

• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)
• Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor
• Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time
• Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack

More from APT38

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns

Previous and next in supply chain

• indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set() Previous report
• GHAPPIER Loader: npm Trusted-Publishing Abuse Compromises @dforge-core/dforge-mcp Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages