FlagThis — Daily Cybersecurity Intelligence Briefing

North Korean state-sponsored actor Sapphire Sleet executed a supply chain attack on the Rust ecosystem by compromising a maintainer account on crates.io. The attackers published malicious versions of arrayref (v0.3.10), internment (v0.8.7), and append-only-vec (v0.1.9), which introduced a typosquatted dependency, proc-macro1. The payload executed during the compilation process via build.rs scripts, enabling host enumeration, browser profile exfiltration, and persistence across Windows, macOS, and Linux. The campaign utilized a Domain Generation Algorithm (DGA) for C2 resiliency and disabled TLS validation to bypass security controls, specifically targeting developer workstations and CI/CD pipelines.