EXECUTIVE SUMMARY:
A supply chain attack targeting the Rust ecosystem compromised multiple crates by introducing malicious code into trusted open-source dependencies. The attackers published tampered versions of Rust packages that delivered a backdoor during the software compilation process, creating a risk for developer environments and continuous integration pipelines. The campaign showed infrastructure similarities with previous supply chain operations associated with DPRK-linked activity, including attacks targeting other software ecosystems.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A supply chain attack targeting the Rust ecosystem compromised multiple crates by introducing malicious code into trusted open-source dependencies. The attackers published tampered versions of Rust packages that delivered a backdoor during the software compilation process, creating a risk for developer environments and continuous integration pipelines. The campaign showed infrastructure similarities with previous supply chain operations associated with DPRK-linked activity, including attacks targeting other software ecosystems.[emaillocker id="1283"]
The attackers compromised Rust crates including arrayref, internment, and append-only-vec, adding a typosquatted dependency named proc-macro1, which impersonated the legitimate proc-macro2 package. The malicious dependency contained a build script that executed automatically during the Cargo compilation process, enabling the download and execution of a second-stage payload. The payload communicated with command-and-control infrastructure over HTTPS, collected system information, enumerated installed applications, accessed browser profile data, established persistence through operating system mechanisms, and supported remote command execution. The malware also used techniques such as encrypted configuration storage, certificate validation bypassing, and fallback domain generation to maintain communication resilience.
It highlights the growing risk of supply chain attacks against widely used open-source packages, where attackers can compromise trusted dependencies to target developers and build environments. Organizations using Rust-based projects should review dependency lock files, identify affected crate versions, investigate potentially compromised build systems, rotate exposed credentials, and ensure software artifacts are rebuilt from trusted sources.
THREAT PROFILE:
| Tactic | Technique Id | Technique | Sub-technique |
| Initial access | T1195.001 | Supply Chain Compromise | Compromise Software Dependencies and Development Tools |
| T1195.002 | Compromise Software Supply Chain | ||
| Execution | T1204.002 | User Execution | Malicious File |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
REFERENCES:
The following reports contain further technical details:
https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
[/emaillocker]