[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFd-etfoDyF75BXsSmItJ_7geCjE0pVDj0pTRy6qVvpg":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"306b9167-fff0-4895-9125-9e9a6fe2fe1f","Rust Supply Chain Attack Linked to North Korean Hackers","rust-supply-chain-attack-linked-to-north-korean-hackers-5c4e2c","Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server. The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek.","North Korean threat actors, identified as Sapphire Sleet, have compromised the popular Rust crate 'arrayref' in a supply chain attack. The attackers pushed a malicious version that fetched a second-stage binary, disabling certificate validation. While the Rust Security Response Team removed the malicious packages, the incident highlights the ongoing threat to open-source software ecosystems.","North Korean hackers compromised Rust's arrayref crate, injecting malicious code to steal data.","https:\u002F\u002Fwww.securityweek.com\u002Frust-supply-chain-attack-linked-to-north-korean-hackers\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F01\u002FSupply-Chain-Software-Attack.jpg","2026-08-21T09:23:18+00:00","2026-08-21T10:00:26.062737+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Sapphire Sleet","threat_actor",{"name":21,"type":22},"arrayref","product",{"name":24,"type":22},"internment",{"name":26,"type":22},"append-only-vec",{"name":28,"type":22},"proc-macro2",{"name":30,"type":31},"Axios","campaign","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":57,"context":58},"build.rs","Malicious build script within the compromised Rust crate.",[21,24,26],{"controls":61,"vendors":145},[62,91,116],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":54,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":112,"product_name":113,"url":114,"description":115},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"north-korean-hackers-poison-popular-rust-crate-in-supply-chain-attack","North Korean Hackers Poison Popular Rust Crate in Supply Chain Attack","State-sponsored North Korean actors (Sapphire Sleet) compromised the widely used Rust crate 'arrayref' by pushing a malicious version that downloaded a second-stage payload and disabled certificate validation, undermining transport-layer trust. This attack illustrates how open-source package ecosystems are attractive, high-leverage targets: a single poisoned dependency can propagate silently into thousands of downstream applications. The disabling of certificate validation is particularly dangerous as it enables man-in-the-middle attacks and removes a critical layer of integrity assurance. The incident underscores that trusting a package by name or historical reputation is insufficient without continuous integrity verification and dependency monitoring.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-218 (SSDF) PW.4: Reuse Existing, Well-Secured Software","NIST CSF ID.SC-4: Suppliers and third-party partners are routinely assessed","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","SLSA Framework Level 2+: Provenance and build integrity requirements","GDPR Article 32: Security of processing (for EU-regulated downstream consumers)","ITIL Change Management: Controlled assessment of third-party component changes",{}]