Skip to content

Back to the catalog

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
wiz.iowriteup

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Wiz researchers found that malicious versions of the Rust crates arrayref, internment, and append-only-vec were published to crates.io, each pulling in a typosquatted build-dependency (proc-macro1, mimicking proc-macro2) whose build.rs executes a remote payload at compile time. The payload beacons to a C2 endpoint (/49890878) shared with the Mastra campaign, disables TLS validation, enumerates Chrome/Brave/Edge saved logins via their SQLite stores, persists via Registry Run keys/LaunchAgents/systemd, and falls back to a DGA — with C2 infrastructure and SSL-issuer overlap tying it to DPRK/Sapphire Sleet activity previously seen in the Mastra and axios supply chain attacks. arrayref is used in roughly 75% of Rust environments, making this a high-impact build-time compromise.

TL;DR Malicious arrayref/internment/append-only-vec Rust crates dropped a compile-time backdoor via typosquatted proc-macro1, with C2 and infra overlapping DPRK's Sapphire Sleet/Mastra campaigns.
Open original ↗
Document

What it is

Wiz's analysis of a crates.io supply-chain attack (published August 20, 2026) that pushed backdoored versions arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. arrayref appears in over 35% of all environments and ¾ of environments where Rust is present, and proc-macro1 was the first dependency ever added to arrayref in its ten-year history — a signal the addition itself was anomalous.

How it works

The malicious versions add proc-macro1 = "1.0.107" (a typosquat of proc-macro2, 154M+ downloads). Its build.rs runs at cargo build time: it reconstructs a C2 URL from Base64 fragments (e.g. https://23.254.165[.]112:9089/), installs an AcceptAll verifier to disable TLS validation, downloads a platform-specific payload (Linux/Windows/macOS x86_64 plus aarch64 macOS), writes it to /tmp/rust-setup or %TEMP%\rust-setup.ps1, and executes it. The stage-two config is AES-128-GCM encrypted with the hardcoded key i am botking; commands are authenticated by an embedded RSA-2048 private key. Four commands: kill, minicfg (reconfigure C2/interval), startup (persistence), runscript. If the primary C2 is unreachable it falls back to a DGA generating 10 .com domains every 5 days (currently unregistered).

Preconditions / Affected

Any developer workstation or CI runner that ran cargo build on a project resolving to the affected versions — no execution of the built binary required.

What to do

  • Search Cargo.lock across repositories for the malicious versions and all six attacker crate names.
  • Treat any host that built an affected project as fully compromised: rotate every reachable credential, token, and key (including CI secrets and signing keys) and rebuild post-exposure artifacts from clean sources.
  • Reset passwords and revoke sessions for Chrome, Brave, and Edge logins on affected hosts.
  • Delete /tmp/rust-setup, %TEMP%\rust-setup.ps1, and %TEMP%\rust-setup-launch.vbs; check for unrecognized systemd user services, HKCU Run entries, and LaunchAgents.
  • Do not resolve yank warnings by upgrading blindly — this attack used yanking to drive upgrades; treat a sudden yank of multiple stable versions of a long-lived crate as an investigation trigger.
  • Review new/changed build-dependencies, especially networking crates (ureq, reqwest, rustls) in crates with no reason to make network calls.

IOC pivot: the beacon IP shares an SSL issuer (WIN-A6QF8AHPQH1\Administrator@WIN-A6QF8AHPQH1) with 23.254.167[.]13, and the /49890878 endpoint appears in the DPRK/Sapphire Sleet-attributed Mastra campaign.

Caveats

Wiz corrected an earlier version of the post: the payload only enumerates saved logins from browser SQLite stores — it does not retrieve the encrypted credential material. Password rotation is still advised as a precaution.

Technologies named here

Techniques named here

Threat actors named here

Related in Supply Chain