North Korea's Sapphire Sleet Targets Rust Supply Chain via arrayref Crate

Overview: North Korean Hackers Strike Rust Ecosystem

A sophisticated supply chain attack targeting the Rust programming language ecosystem has been attributed to the North Korean threat actor Sapphire Sleet. The incident, which occurred on August 20, involved the compromise of a legitimate maintainer’s account for arrayref, a highly popular Rust crate with over 245 million downloads, utilized in approximately 75% of Rust environments. Cybersecurity firm Wiz reported this activity, as highlighted by SecurityWeek.

The malicious activity was swiftly detected by the Rust Security Response Team, who confirmed the compromise and removed the poisoned packages approximately 86 minutes after their publication. While the maintainer of arrayref is not believed to be malicious, their account or computer was likely compromised. The Rust security team found no evidence of widespread actual usage of the malicious crates, indicating that the quick response limited potential impact. Nonetheless, this incident underscores the persistent threat of nation-state actors targeting open-source supply chains.

Technical Details of the Malicious Operation

The attack unfolded with precision, beginning with the publication of arrayref@0.1.2 to crates.io from its legitimate owner’s account. This version contained a direct dependency on proc-macro1, a typosquatted package designed to impersonate the legitimate proc-macro2 crate. Within this deceptive dependency, the threat actor concealed a malicious build.rs file. This script was engineered to fetch a platform-specific second-stage binary over TLS, notably after disabling certificate validation to bypass security checks.

Shortly after the initial arrayref compromise, poisoned versions of internment and append-only-vec – two other crates from the same compromised owner – were also released. Furthermore, several attacker-owned crates, including aovine, arone, aronenao, and tinymember, were identified referencing the same malicious proc-macro1 dependency. Analysis by StepSecurity revealed that the threat actor meticulously planned these steps, including creating the typosquatted proc-macro2 version and an impersonating account just prior to the arrayref release. This level of preparation demonstrates advanced capabilities in orchestrating a Rust ecosystem supply chain attack detection challenge.

Attribution to Sapphire Sleet and Overlapping Campaigns

Attribution to the North Korean threat actor Sapphire Sleet was made by Wiz, citing substantial infrastructure overlaps with previous supply chain campaigns. Sapphire Sleet, known for the Axios and Mastra NPM supply chain attacks in April and June, utilized similar tactics and infrastructure. Evidence for this attribution includes arrayref payloads beaconing to an endpoint previously used in the Mastra attack. Additionally, command-and-control (C&C) traffic was recorded to an IP address linked to the Axios campaign, and the same Hostwinds LLC IP range was observed across all three incidents. These commonalities provide a clear pattern of Sapphire Sleet TTPs for supply chain attacks, highlighting their continued focus on open-source software ecosystems to achieve their objectives.

Mitigations and Recommendations

For organizations utilizing Rust, mitigating the risks associated with such supply chain attacks requires proactive measures and diligent monitoring. Given the potential for a compromised Rust crate maintainer account, immediate action is crucial:

• Dependency Auditing: Users of the arrayref crate should immediately audit their dependencies to ensure they are not using the malicious arrayref@0.1.2 version. All projects should update to the clean, restored iterations of arrayref and its related crates (internment, append-only-vec).
• Verify Package Integrity: Implement automated tools and processes to verify the integrity and authenticity of all third-party packages and their dependencies. This includes checking for signs of typosquatting or unexpected package versions.
• Supply Chain Security Practices: Adopt and enforce comprehensive supply chain security best practices. This involves scrutinizing new versions of critical dependencies, especially those from popular or widely used packages.
• Account Security for Maintainers: Open-source project maintainers should employ strong security practices, including multi-factor authentication (MFA) and regular credential rotation, to protect their accounts from compromise.
• Network Monitoring: Monitor network traffic for unusual connections originating from build environments or production systems, especially those attempting to fetch binaries from unverified external sources or disabling certificate validation.

Related: Critical: Rust arrayref Crate Poisoned with Infostealer Malware, Rust Supply Chain Attack Puts Build-Time Malware in Crates