North Korean State-Sponsored Supply Chain Attack on Rust's crates.io
North Korean state-sponsored actor Sapphire Sleet executed a supply chain attack on the Rust ecosystem by compromising a maintainer account on crates.io. The attackers published malicious versions of arrayref (v0.3.10), internment (v0.8.7), and append-only-vec (v0.1.9), which introduced a typosquatted dependency, proc-macro1. The payload executed during the compilation process via build.rs scripts, enabling host enumeration, browser profile exfiltration, and persistence across Windows, macOS, and Linux. The campaign utilized a Domain Generation Algorithm (DGA) for C2 resiliency and disabled TLS validation to bypass security controls, specifically targeting developer workstations and CI/CD pipelines.
Sapphire Sleet Targets HuggingFace and macOS for Cryptocurrency Exfiltration
North Korean state-sponsored actor Sapphire Sleet (UNC1069) has launched a targeted campaign against macOS users within the AI/ML and cryptocurrency sectors. The adversary utilizes HuggingFace as a delivery vector, deploying malicious models and repository-based lures coupled with AI-enhanced social engineering to compromise developer environments. Once execution is achieved via macOS-specific payloads, the threat actor deploys specialized modules to harvest SSH keys and exfiltrate cryptocurrency wallet data. This shift indicates a tactical pivot toward high-value individual targets and the exploitation of trust in AI model repositories to bypass traditional perimeter defenses.