A coordinated supply chain attack compromised legitimate Rust crates maintained by David Roundy and injected a malicious proc-macro1 dependency that executed cross-platform malware during Cargo builds. The attack deployed a stage-1 loader and stage-2 backdoor across Linux, macOS, and Windows, with network activity tied to 23[.]254[.]165[.]112 and related fallback domains. #arrayref #internment #append-only-vec #proc-macro1 #RustSec #Socket #DavidRoundy
Keypoints
- Three legitimate Rust crates were compromised: [email protected], [email protected], and [email protected].
- The malicious releases added a dependency on proc-macro1, a typosquat impersonating proc-macro2.
- Cargo automatically executed the malicious build.rs during compilation, enabling build-time code execution without direct import.
- The malware downloaded platform-specific payloads and ran on Linux, macOS, and Windows.
- The stage-2 backdoor profiled hosts, inventoried Chromium-based browsers, and established persistence through OS-specific mechanisms.
- The Rust Security Response Team removed the affected releases and locked the maintainer account after suspecting credential or workstation compromise.
- Organizations are advised to treat systems that built the malicious versions as potentially compromised and rotate exposed secrets.
MITRE Techniques
- [T1195 ] Supply Chain Compromise – The attacker compromised legitimate crates and inserted a malicious dependency into published releases (‘A coordinated supply chain attack affecting three legitimate Rust crates’).
- [T1059.006 ] Command and Scripting Interpreter: Python – Not mentioned.
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – On Windows, the malware launches hidden PowerShell with ExecutionPolicy Bypass (‘it then uses wscript.exe to launch hidden PowerShell with ExecutionPolicy Bypass’).
- [T1059.005 ] Command and Scripting Interpreter: Visual Basic – Wscript is used to launch a VBS helper file (‘it creates … rust-setup-launch.vbs’ and ‘uses wscript.exe’).
- [T1204.002 ] User Execution: Malicious File – A normal Cargo build triggers the malicious dependency automatically during compilation (‘a developer can be infected simply by running a normal Cargo build’).
- [T1105 ] Ingress Tool Transfer – The loader downloads platform-specific payloads from the attacker server (‘Downloads a platform-specific payload from 23[.]254[.]165[.]112:9089’).
- [T1027 ] Obfuscated Files or Information – The C2 addresses are Base64-obfuscated in the loader (‘Reconstructs Base64-obfuscated C2 addresses’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The backdoor communicates with C2 over HTTP(S)-style endpoints and beacon paths (‘Beacons to /49890878’).
- [T1562.001 ] Impair Defenses – The loader disables TLS certificate verification (‘Disables TLS certificate verification’).
- [T1057 ] Process Discovery – The malware profiles the host, including installed applications and system details (‘Profiles the host, including username, hostname, OS, architecture, privilege level, and installed applications’).
- [T1012 ] Query Registry – On Windows, persistence is established through an HKCU Run key (‘Establishes user-level persistence through an HKCU Run key on Windows’).
- [T1543.003 ] Create or Modify System Process: Windows Service – Not mentioned.
- [T1543.001 ] Create or Modify System Process: Launch Agent – On macOS, persistence is established via a LaunchAgent (‘or a LaunchAgent on macOS’).
- [T1543.002 ] Create or Modify System Process: Systemd Service – On Linux, persistence is established via a systemd user service (‘or a systemd user service on Linux’).
- [T1083 ] File and Directory Discovery – The backdoor inventories browser-related data and system artifacts (‘Inventories Chromium-based browsers’).
Indicators of Compromise
- [IP addresses] attacker infrastructure and C2 – 23[.]254[.]165[.]112, 23[.]254[.]165[.]112:443
- [Ports] payload retrieval and C2 communication – 9089, 443
- [URLs] payload download and beaconing endpoints – hxxps://23[.]254[.]165[.]112:9089/rust-crate_0.1.0, hxxps://23[.]254[.]165[.]112:443/49890878
- [File names] host artifacts created by the loader – /tmp/rust-setup, rust-setup.ps1, rust-setup-launch.vbs
- [File hashes] malicious loader and recovered stage-2 payloads – cb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568, 408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434, and 2 more hashes
- [Domains] DGA hunting indicators – rasGThauFD[.]com, feVVKIiEiU[.]com, and 8 more domains
- [Package names and versions] compromised and related crates – [email protected], [email protected], [email protected], [email protected], [email protected]
Read more: https://socket.dev/blog/popular-rust-crates-compromised