Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)
Rust Team Members and Popular Crate Owners Targeted via Fake (TL-2026-2603), also tracked as arrayref Supply Chain Attack, is a high-severity supply-chain compromise, first published 2026-09-21. It is attributed to APT38 (North Korea) with medium confidence, affects crates.io / Rust ecosystem arrayref, maps to 18 MITRE ATT&CK techniques (T1027, T1036.005, T1059.001), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2603
- Threat ID
- TL-2026-2603
- Also known as
- arrayref Supply Chain Attack, RUSTSEC-2026-0260, Rust Crate Supply Chain Attack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-21
- Last reviewed
- 2026-09-21
- Attribution
- APT38
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open source software, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
North Korea-linked operators are running an ongoing video-call social-engineering campaign against Rust-lang team members and popular crate owners, using fake job/contract pretexts to push a bogus 'missing audio codec' install or a clipboard paste-and-run command. The Rust Security Response Working Group's September 17, 2026 alert ties the campaign to the August 20, 2026 compromise of the arrayref, append-only-vec, and internment crates via a malicious proc-macro1 typosquat dependency whose build.rs deployed a credential-stealing backdoor; Wiz researchers link the C2 infrastructure to the Microsoft-attributed Sapphire Sleet/DPRK cluster behind the Mastra npm and axios npm supply-chain attacks.
How Rust Team Members and Popular Crate Owners Targeted via Fake works
On September 17, 2026, the Rust Security Response Working Group and the crates.io team (statement posted by Adam Harvey) publicly warned of an ongoing, targeted social-engineering campaign against rust-lang team members and popular crate owners. The operators set up video calls under false pretexts -- a job offer, a paid project, or a contract opportunity -- backed by newly registered, plausible-looking company identities and LinkedIn profiles. Mid-call, targets are pressured to either install a purportedly missing audio codec (a disguised malware dropper) or copy-and-paste and execute a command supplied by the caller (a ClickFix-style clipboard-hijacking technique). The Rust team explicitly attributes this attack style to North Korea, noting it has also been observed against developer communities outside the Rust ecosystem, and links the current wave to a similar campaign that targeted numerous prominent Rust developers in June 2026 (exact date not disclosed).
The alert also ties this social-engineering campaign to a concrete supply-chain compromise: on August 20, 2026, a compromised crates.io maintainer account was used to publish malicious versions of three widely used crates -- arrayref 0.3.10 (245M+ historical downloads, present in an estimated 75% of cloud environments running Rust), append-only-vec 0.1.9, and internment 0.8.7. Each added a dependency on a newly published package, proc-macro1, a typosquat of David Tolnay's legitimate proc-macro2, published from an account ('dtolney') impersonating Tolnay. proc-macro1's build.rs script ran automatically at `cargo build` time: it reconstructed a C2 address from base64-encoded fragments, disabled TLS certificate validation, downloaded a platform-specific second-stage binary (Linux/Windows/macOS x86_64 and macOS arm64), wrote it to /tmp/rust-setup or %TEMP%\rust-setup.ps1, and executed it. The second-stage backdoor beacons over HTTPS to a /49890878 endpoint, steals credentials from Chrome/Brave/Edge profiles, persists via Registry Run keys (Windows), LaunchAgents (macOS), or systemd user services (Linux), supports remote commands (kill/minicfg/startup/runscript), encrypts its configuration with AES-128-GCM, authenticates commands with RSA-2048, and falls back to a DGA producing 10 .com domains every 5 days if its hardcoded C2 is unreachable. The malicious releases were live on crates.io for only 86-107 minutes (07:15-08:41/09:25 UTC) before removal, but arrayref's popularity meant real exposure for any project or CI pipeline that compiled against it in that window. Older, safe arrayref releases (0.3.5-0.3.9) were yanked to nudge developers toward installing the malicious 0.3.10.
Wiz researchers (Rami McCarthy, Benjamin Read) attributed the arrayref infrastructure to North Korea based on infrastructure overlap rather than a formal claim: the C2 beacon path (/49890878) matches the path used in the Microsoft-attributed 'Sapphire Sleet' compromise of 140+ Mastra AI npm packages in June 2026; the arrayref and Mastra C2 hosts share an SSL certificate issuer; and both campaigns, plus a related UNC1069 (Google-attributed North Korea cluster) compromise of the axios npm package, used IP space in Hostwinds LLC's 23.254.164.0/23 range (treated as weaker, corroborating evidence since Hostwinds serves many customers). Sapphire Sleet is also tracked as BlueNoroff, STARDUST CHOLLIMA, and CageyChameleon, and is linked to the broader 'Contagious Interview' cluster -- fake-recruiter campaigns that have delivered backdoors (OtterCookie, BeaverTail, InvisibleFerret, FlexibleFerret) to npm/PyPI developers via fake coding tests, and separately, ClickFix-style fake-software-update lures (e.g., 'Zoom SDK Update.scpt') against macOS targets. A concurrent September 18, 2026 law-enforcement advisory (Australia, Germany, Japan, US) on a related North Korea-linked fake-job-interview scheme, tracked as WaterPlum, reported 30,000+ compromised devices and $10.71M in confirmed cryptocurrency losses across web/software/Web3 professionals -- illustrating the same TTP class operating at scale against the wider developer ecosystem, though the source reporting does not confirm WaterPlum and this arrayref/video-call campaign are the same operation.
No CVE was assigned to any of this activity. RustSec issued RUSTSEC-2026-0260 (arrayref) and companion advisories for append-only-vec and internment; proc-macro1 was deleted from crates.io entirely.
MITRE ATT&CK techniques used in TL-2026-2603
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.001 PowerShell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1568.002 Domain Generation Algorithms; T1573.001 Symmetric Cryptography
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1566.004 Spearphishing Voice
Persistence
T1543.001 Launch Agent; T1543.002 Systemd Service; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware; T1608.001 Upload Malware
Affected products and versions in Rust Team Members and Popular Crate Owners Targeted via Fake
- crates.io / Rust ecosystem — arrayref
Vulnerable versions: 0.3.10
Fixed in: removed from registry; use a subsequent legitimate release - crates.io / Rust ecosystem — append-only-vec
Vulnerable versions: 0.1.9
Fixed in: removed from registry; use a subsequent legitimate release - crates.io / Rust ecosystem — internment
Vulnerable versions: 0.8.7
Fixed in: removed from registry; use a subsequent legitimate release - crates.io / Rust ecosystem — proc-macro1 (typosquat of proc-macro2)
Vulnerable versions: 1.0.106; 1.0.107
Fixed in: package deleted entirely from crates.io
Remediation for Rust Team Members and Popular Crate Owners Targeted via Fake
Patches
- No vendor patch applicable. crates.io deleted the proc-macro1 package entirely and removed the malicious arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7 releases; upgrade to a subsequent legitimate, non-malicious release.
Immediate actions
- Treat unsolicited recruiting/contract video-call outreach to Rust maintainers as suspicious; independently verify the counterparty's company and LinkedIn presence before joining a call.
- Never install a codec, driver, or 'meeting plugin' requested mid-call, and never paste or execute a command placed on your clipboard by a call participant (ClickFix pattern).
- Audit crates.io and GitHub account security for Rust maintainers/crate owners: enable MFA, review active sessions and API tokens, and rotate credentials if compromise is suspected.
- Pin exact dependency versions via Cargo.lock and review new transitive dependencies (e.g., proc-macro1) before allowing `cargo build` to execute their build.rs.
- Block or alert on network egress to 23.254.164.0/23 (Hostwinds) and the listed C2 IPs/domain; hunt for HTTPS POST requests to a numeric path like /49890878.
Workarounds
- Allow-list build-script network access; refuse to build crates that introduce new, unreviewed proc-macro dependencies; verify maintainer/account identity changes before upgrading a dependency.
Longer-term hardening
- Adopt build isolation/sandboxing for `cargo build` (deny network egress, restrict arbitrary build.rs execution) especially in CI/CD pipelines.
- Require crates.io publishers -- especially owners of high-download-count crates -- to use hardware-token MFA and undergo periodic account security reviews.
- Deploy EDR/behavioral detection for build-time process trees (cargo/rustc spawning outbound network connections or writing to %TEMP%/ /tmp).
- Build organizational awareness of North Korea-linked 'fake job interview' recruiting lures targeting developers (Contagious Interview / Sapphire Sleet TTP family).
Weaknesses (CWE) in Rust Team Members and Popular Crate Owners Targeted via Fake
CWE-506, CWE-829
Timeline of Rust Team Members and Popular Crate Owners Targeted via Fake
- Rust Security Response Working Group discloses a prior video-call social-engineering campaign in June 2026 that targeted numerous prominent Rust developers using the same fake job/contract pretext (exact day not disclosed in source reporting).
- The RustSec Advisory Database publishes RUSTSEC-2026-0260 for arrayref and companion advisories for append-only-vec and internment.
- Malicious crate versions are removed from the crates.io index between roughly 08:03 and 08:41 UTC, with proc-macro1 fully deleted by 09:25 UTC -- an exposure window of 86-107 minutes.
- The compromise is reported to the crates.io security team at approximately 07:54 UTC.
- Compromised versions arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7 are published to crates.io at approximately 07:15 UTC via a hijacked maintainer account, each depending on the malicious proc-macro1; older safe arrayref releases 0.3.5-0.3.9 are yanked to funnel users onto 0.3.10.
- Benign-looking proc-macro1 1.0.106 is published as a typosquat of David Tolnay's legitimate proc-macro2, followed by malicious proc-macro1 1.0.107 containing the build.rs payload.
- Attacker-controlled crates.io/GitHub accounts, including one impersonating Rust developer David Tolnay ('dtolney'), are created around 01:17 UTC to stage the typosquat package proc-macro1.
- Wiz researchers (Rami McCarthy, Benjamin Read) publish analysis linking the arrayref C2 infrastructure (path /49890878, shared SSL issuer, Hostwinds 23.254.164.0/23 range) to the Microsoft-attributed Sapphire Sleet/DPRK Mastra npm campaign and the Google-attributed UNC1069 axios npm campaign.
- The Rust Security Response Working Group and crates.io team (Adam Harvey) publish 'Be alert: targeted attacks on prominent Rustaceans,' warning of an ongoing video-call campaign against rust-lang members and popular crate owners using fake missing-audio-codec installs or clipboard paste-and-run commands, and attributing the technique to North Korea.
- Australian, German, Japanese, and US law enforcement issue a joint advisory on a related North Korea-linked fake-job-interview campaign (tracked as WaterPlum), reporting 30,000+ devices compromised and $10.71M in confirmed cryptocurrency losses across web/software/crypto professionals.
- SecurityWeek reports on the Rust Security Response Working Group's alert, the source article for this threat record.
Sources cited for Rust Team Members and Popular Crate Owners Targeted via Fake
- Be alert: targeted attacks on prominent Rustaceans
- Rust team members and popular crate owners targeted via video calls
- Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
- RUSTSEC-2026-0260: arrayref malicious dependency advisory
- CSA Research Note: arrayref Rust Supply Chain DPRK Overlap
- Hackers poison arrayref Rust crate to push infostealer malware
- North Korean Hackers Tied to Rust Supply Chain Attack
- North Korea's fake job interviews infected 30,000 devices
- Dissecting Sapphire Sleet's macOS intrusion from lure to compromise
- Contagious Interview: Malware delivered through fake developer job interviews
- RUSTSEC-2026-0260 (OSV entry)
- Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
More in supply chain
- indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()
- GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign
- Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
- PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting
- Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected
Detection coverage for TL-2026-2603
As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2603 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2603
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.