Three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9) maintained by David Roundy were compromised by a threat actor who injected a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. The malicious build.rs script executed automatically during Cargo builds, downloading and executing cross-platform malware targeting Linux, macOS, and Windows. The stage-2 backdoor profiled hosts, inventoried browsers, established persistence, and beaconed to a C2 at 23.254.165.112. The threat actor also yanked older legitimate arrayref releases to steer dependency resolution toward the malicious version. Socket's AI Scanner detected the attack on August 20, 2026, and the Rust Security Response Team removed affected releases and locked the maintainer account. Any system that built one of the malicious versions should be treated as potentially compromised, with credentials rotated and persistence mechanisms investigated.
A threat actor compromised the crates.io publishing credentials or computer of legitimate Rust crate maintainer David Roundy (droundy) and published malicious versions of three popular crates: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. Each malicious release added a dependency on proc-macro1@1.0.107, a threat actor-controlled typosquat impersonating the widely used proc-macro2 crate. When Cargo resolves dependencies and builds the project, it automatically executes proc-macro1's build.rs script without any explicit import or call from the developer. The malicious build.rs: reconstructs Base64-obfuscated C2 addresses, detects victim OS and architecture, disables TLS certificate verification, downloads a platform-specific payload from 23.254.165.112:9089, and executes it while passing 23.254.165.112:443 as a C2 endpoint. On Linux/macOS, the malware writes /tmp/rust-setup, makes it executable, and launches it detached. On Windows, it creates %TEMP%\rust-setup.ps1 and %TEMP%\rust-setup-launch.vbs, then uses wscript.exe to launch hidden PowerShell with ExecutionPolicy Bypass. Stage-2 payloads were recovered for Linux x86-64, Windows x86-64, and macOS ARM64. All variants share the same protocol, configuration structure, command set, and cryptographic key material, confirming they are variants of the same cross-platform backdoor. Once executed, the stage-2 malware: profiles the host (username, hostname, OS, architecture, privilege level, installed applications), inventories Chromium-based browsers (visited login origins, usernames, installed extensions), establishes user-level persistence (HKCU Run key on Windows, systemd user service on Linux, LaunchAgent on macOS), beacons to /49890878 and supports C2 commands for configuration changes, persistence establishment, script/command download and execution, and implant termination, and falls back to ten deterministic date-based DGA .com domains when primary C2 is unavailable. The threat actor also yanked several older legitimate arrayref releases to steer dependency resolution toward the malicious 0.3.10 version. Additional threat actor-controlled crates were identified: proc-macro-en@1.0.10 (same malicious build.rs), and staging/test packages aovine, arone, aronenao, and tinymember. A weakness was identified in the backdoor: the same RSA private key is embedded across all recovered payloads, and the implementation does not provide exclusive operator authentication, combined with predictable DGA enabling potential sinkholing.
1. Search Cargo.lock, dependency inventories, build logs, and Cargo caches for: arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember. 2. Pin affected legitimate crates to safe versions: arrayref <= 0.3.9, internment <= 0.8.6, append-only-vec <= 0.1.8. 3. Treat any system that built a malicious version as potentially compromised. 4. Hunt for network connections to 23.254.165.112 on ports 9089 and 443. 5. Hunt for user-level persistence established after the build: HKCU Run entries (Windows), systemd user services (Linux), macOS LaunchAgents. 6. Search for host artifacts: /tmp/rust-setup, rust-setup.ps1, rust-setup-launch.vbs. 7. Investigate suspicious wscript.exe or PowerShell execution associated with Cargo builds. 8. Rotate all credentials and secrets accessible to affected build environments, including source-control credentials, package publishing tokens, cloud credentials, signing material, and deployment secrets. 9. Rebuild affected software from a known-clean system. 10. Block all threat actor-controlled crates consistent with Rust's remediation guidance. 11. Monitor for DGA fallback domains listed in IOCs for August 20-24, 2026 UTC period.
23.254.165.112:9089, 23.254.165.112:443, hxxps://23.254.165.112:443/49890878, hxxps://23.254.165.112:9089/rust-crate_0.1.0, hxxps://23.254.165.112:9089/rust-crate_0.2.0, hxxps://23.254.165.112:9089/rust-crate_0.3.0, hxxps://23.254.165.112:9089/rust-crate_0.4.0, 408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434, 492f2ab86f8d8911adc79c10ec1541704f5311d207d9d799b0d2a57fcc6a4391, c9561a3b00a0fa38b7772675d987f84bd429c55cd024fc08a98245c2d1632848, 74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306, cb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568, /tmp/rust-setup, %TEMP%\rust-setup.ps1, %TEMP%\rust-setup.ps1.cfg, %TEMP%\rust-setup-launch.vbs, %TEMP%\ps-<GUID>.ps1, %APPDATA%\<operator-controlled folder>\<name>.ps1, %APPDATA%\<operator-controlled folder>\<name>.ps1.cfg, rasGThauFD.com, feVVKIiEiU.com, phrpjTNckF.com, PrOkXLgfjW.com, ackeoTaWtl.com, GAFWVCMAja.com, RNSsddnEgK.com, pfHlVOqEeg.com, aBEcOrkups.com, epOdIaTMaM.com
