Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates.
In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors linked to the government of North Korea.
According to multiple reports, unknown threat actors this week compromised the maintainer account behind arrayref, a widely used package with more than 245 million downloads that Sai Likhith, backend engineer with StepSecurity, described as a “tiny array-conversion utility” that is “one of the Rust ecosystem’s quiet load-bearing crates.”
Over the next 23 minutes, as part of the same attack, the hackers poisoned two other crates from the same owner, append-only-vec and internment. In addition, the attackers published versions of four other crates – aovine, arone, aronenao, and tinymember – which have been removed from crates.io.
Also, the releases published by the attacker – arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 – from the same compromised owner account, were removed. All were published with the same typosquatted dependency (proc-macro1), which came with a build script that downloaded and executed a remote payload.
Avoiding Detection
“Because build scripts run during compilation, building an affected project was sufficient to execute the payload,” Wiz researchers Rami McCarthy and Benjamin Read wrote in their report. “arrayref can be found in over 35% of all environments. Even more notably, it’s used in ¾ of all environments where Rust is present.”
The hackers put a lot of effort into keeping the attack below the radar. Two days before the malicious arrayref, append-only-vec, and internment releases were published, seven versions of arone and 11 of aronenoa were published, with both carrying malicious build scripts and both owned by the same account as tinymember, according to StepSecurity’s Likhith.
Five hours before the malicious arrayref, append-only-vec, and internment releases hit, the hackers created a GitHub account that impersonated that of Rust developer David Tolnay, the arrayref maintainer. The name on the typosquatted account was only one letter off from Tolnay’s. It published proc-macro1@1.0.106, a full copy of the legitimate proc-macro2 source but without a build script. It essentially was a clean decoy, whose “sole purpose is to establish publishing history so the crate does not appear as a zero-history package during later inspection,” Likhith wrote.
Researchers wrote that it was likely Tolnay’s computer or credentials were compromised.
Yanking Legitimate Versions
The hackers, 24 seconds after publishing arrayref version 0.3.10 with the malicious dependency – the crate hadn’t added a dependency in 10 years – yanked every legitimate version of arrayref@0.3.x – 0.3.9, 0.3.8, 0.3.7, 0.3.6, 0.3.5 – four seconds apart, a move that he called “the upgrade lure.”
“The intended victim psychology is obvious: developers and CI maintainers see a scary new warning on a dependency with 152 million downloads, and the ‘responsible’ fix, cargo update -p arrayref, resolves to the single non-yanked modern release: 0.3.10,” Likhith wrote. “The original reporter states this is exactly how they were hit. The attacker turned the registry’s own safety feature into the delivery channel.”
Exfiltrating Data
According to Wiz’s McCarthy and Read, at compile time, the build script reconstructs a command-and-control (C2) URL from Base64 fragments, disables TLS certificate validation using a custom AcceptAll verifier, and downloads a payload based on the operating system and architecture of the host, writing it to disk on Unix or Windows. It then executes the payload and passes the C2 beacon address.
A backdoor beacons to the C2 and exfiltrates the host’s information and stolen credentials. It collects the hostname, username, and operating details, checks the installed applications, reads Chromes, Brave, and Edge profiles looking for saved logins and extension settings, and queries the browsers’ SQLite credential stores. The malware establishes persistence in the Windows, macOS, and Linux systems and includes four commands that terminate its work, reconfigures the C2 and beacon interval, installs persistence, and downloads and executes PowerShell or shell scripts.
It “falls back to a Domain Generation Algorithm if the primary C2 is unreachable, generating 10 algorithmic .com domains every 5 days,” they wrote.
Links to North Korean Groups
McCarthy and Read also wrote that the infrastructure used to target arrayref “substantially overlaps” with that of recent North Korean supply-chain attacks. The C2 endpoint used in the arrayref campaign was used in a npm supply-chain attack on open source Mastra framework outlined by Microsoft and attributed to a group it calls Sapphire Sleet. The IP addresses found in both campaigns share an SSL issuer.
In March, Google Threat Intelligence Group found that C2 traffic in a compromise of the Axios npm package linked to UNC1069, another North Korea-nexus group used the same IP for C2 traffic as did the arrayref hackers. There also is the same use of the Hostwinds infrastructure.