Full Report
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
Analysis Summary
# Threat Actor: Sapphire Sleet (North Korea / DPRK)
## Attribution & Identity
* **Attribution:** Attributed to North Korea (DPRK) by Microsoft and Mandiant.
* **Aliases:** Sapphire Sleet, UNC1069.
* **Associated Groups:** Linked to wider North Korean state-sponsored operations known for supply chain compromises.
## Activity Summary
In August 2026, the actor executed a sophisticated supply chain attack targeting the Rust ecosystem. By compromising the credentials of a legitimate maintainer, the actor published malicious versions of three widely used crates: `arrayref`, `internment`, and `append-only-vec`. These crates included a typosquatted dependency, `proc-macro1`, which executed a multi-stage backdoor during the compilation process. This campaign shows significant infrastructure and TTP overlap with the "Mastra" (NPM) and "axios" (NPM) attacks previously attributed to DPRK actors.
## Tactics, Techniques & Procedures
* **Supply Chain Compromise:** Hijacking legitimate maintainer accounts to push malicious updates to package registries (crates.io).
* **Typosquatting:** Creating a malicious dependency named `proc-macro1` to mimic the legitimate `proc-macro2`.
* **Compile-Time Execution:** Leveraging `build.rs` scripts in Rust to execute code as soon as a developer builds their project.
* **Defense Evasion:** Disabling TLS certificate validation via a custom verifier to bypass security inspection.
* **Persistence:**
* **Windows:** Registry Run keys.
* **macOS:** LaunchAgents.
* **Linux:** systemd user services.
* **Credential Theft:** Targeted harvesting of browser credentials from Chrome, Brave, and Edge using SQLite queries.
* **Resilient C2:** Implementation of a Domain Generation Algorithm (DGA) that generates 10 domains every 5 days if the primary C2 is unavailable.
* **Cryptography:** Commands authenticated via RSA-2048 and configuration encrypted with AES-128-GCM (Hardcoded key: `i am botking`).
## Targeting
* **Sectors:** Technology, Software Development, and Decentralized Finance (implied by the use of Rust/arrayref).
* **Geography:** Global (targeting developer environments worldwide).
* **Victims:** Specifically developers and organizations using the `arrayref` crate, which is present in approximately 75% of all Rust-enabled environments.
## Tools & Infrastructure
* **Malware:** Custom Rust-based backdoor with platform-specific payloads for Windows, Linux (x86_64), and macOS (x86_64/aarch64).
* **Malware Capabilities:** `kill`, `minicfg`, `startup`, and `runscript`.
* **Host Provider:** Frequent use of **Hostwinds LLC** (specifically the `23.254.164.0/23` range).
* **C2 Infrastructure:**
* `https://23.254.165[.]112:9089/`
* `23.254.167[.]13`
* `23.254.167[.]216`
* C2 URI Pattern: `/49890878`
* SSL Issuer: `WIN-A6QF8AHPQH1\Administrator@WIN-A6QF8AHPQH1`
## Implications
This campaign demonstrates the continued focus of North Korean actors on the developer supply chain. By targeting "low-level" libraries like `arrayref`—which are often transitive dependencies deep in a software stack—the actor achieves massive reach. The ability to execute code at compile time bypasses many traditional runtime security controls, turning the developer's own machine into an entry point for corporate espionage or financial theft.
## Mitigations
* **Dependency Auditing:** Use tools like `cargo deny` or `cargo audit` to inspect dependency trees for unauthorized changes or known malicious crates.
* **Lockfile Review:** Carefully inspect changes to `Cargo.lock` and `Cargo.toml`, specifically looking for new dependencies added to long-standing projects.
* **Network Filtering:** Block outbound traffic to known Hostwinds IP ranges and the specific C2 indicators provided.
* **Environment Isolation:** Conduct software builds in isolated environments or containers that lack access to sensitive host credentials (like browser profiles) and have restricted egress.
* **Rotate Credentials:** Because the malware targets browser-stored credentials, any developer suspected of running the malicious crates should rotate all secrets and passwords immediately.