Researchers found significant infrastructure overlap between the attack on three Rust crates and recent North Korea-linked campaigns.
Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor that executed automatically when affected projects were compiled.
Security researchers at Wiz said the attack also shares infrastructure with recent supply-chain campaigns attributed to North Korean threat actors.
The compromised releases were “arrayref@0.3.10”, “internment@0.8.7,” and “append-only-vec@0.1.9.” All three introduced a dependency on “proc-macro1,” a typosquat of the legitimate and widely downloaded “proc-macro2” crate.
The malicious dependency contained a build script that downloaded and executed a second-stage payload during compilation, Wiz researchers said in a blog post. “The second stage payload is selected based on the platform, with support for x86_64 versions of Linux, Windows, and macOS, in addition to aarch64 macOS,“ they added.
A StepSecurity analysis noted that arrayref has 245 million all-time downloads, with 53.7 million of them happening in the last 90 days. The cybersecurity outfit estimated per-crate exposure windows at 86, 90, and 107 minutes, respectively, before all of them were deleted along with other associated crates.
The attack was first reported to RustSec and security@rust-lang.org by researcher jhobern, but only the arrayref compromise was known at the time.
The malicious code ran at build time
The attack did not require developers to execute suspicious code or even call a function from arrayref. “Because Rust build scripts run at compile time, simply building any project whose lockfile resolved arrayref 0.3.10 was enough to detonate the payload. The crate’s code never needs to be called,” StepSecurity researchers said.
When the affected package was built, the “Cargo.toml” configuration file added proc-macro1 as a dependency. This dependency then reconstructed a command-and-control (C2) URL from Base64 fragments, disabled TLS certificate validation, downloaded a platform-specific payload, and executed it as part of the normal build process.
Wiz found the payload collecting host, username, and operating-system information, enumerating installed applications and inspecting Chrome, Brave, and Edge profiles for saved-login and extension information.
It could also establish persistence through Windows Registry Run keys, macOS LaunchAgents or Linux systemd user services, and accept commands to reconfigure itself, terminate, or download and execute scripts.
The payload supported Linux, Windows, and macOS, including Apple Silicon Macs. It featured a fallback domain-generation mechanism that could generate 10 .com domains every five days if the primary C2 became unavailable.
Links to North Korean campaigns
Wiz said the payload’s infrastructure “substantially overlaps” with operations attributed to recent DPRK actors.
The strongest link is the C2 request path, it said. The backdoor communicates with an endpoint also used in the Mastra campaign, which Microsoft attributed to the DPRK-linked Sapphire Sleet. The IP infrastructure used in the arrayref campaign also shares an SSL certificate issuer with the infrastructure associated with that operation.
Another connection was found with the Axios npm supply-chain campaign. Wiz said a victim reported C2 traffic involving an IP address that also appeared in Google Cloud Threat Intelligence’s analysis of the Axios attack, which Mandiant has linked to North Korea.
Wiz recommended that organizations search “Cargo.lock” files and local Cargo caches for the compromised versions and attacker-controlled packages. It also said that any developer workstation or CI runner that actually built an affected project should be treated as compromised, with accessible credentials, tokens, and keys rotated and artifacts rebuilt from clean sources.