[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ_bAvUzPi3WwsNdtE3446A_cmeERziu9ALNlb4QseDg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":49},"331ab3fb-2330-49b1-9eb3-032e6db2370a","rust-developers-targeted-by-north-korea-linked-social-engineering-via-fake-video-job-interviews","48acd027-8cb7-4992-b27a-91a4bde2df3d","Rust Developers Targeted by North Korea-Linked Social Engineering via Fake Video Job Interviews","Attackers are impersonating recruiters in video calls to trick Rust team members and popular crate owners into installing malware or executing malicious code under the guise of job offers. This campaign mirrors well-documented North Korean threat actor tactics (e.g., 'Contagious Interview' \u002F Lazarus Group operations), where trusted developers in open-source ecosystems are prime targets due to their privileged access to widely-used packages. A compromised crate owner could introduce malicious code into dependencies affecting thousands of downstream projects. This matters because the supply chain impact extends far beyond the individual victim — a single successful compromise can cascade into a widespread software supply chain attack. Human manipulation, not technical exploitation, is the entry point, making technical defenses alone insufficient.","**Immediate actions:**\n- Educate all Rust project contributors and crate owners about this specific campaign and the red flags of fake recruiter video calls.\n- Establish a verified, out-of-band communication channel (e.g., official mailing list or Signal group) for team members to quickly report and validate suspicious outreach.\n\n**Long-term improvements:**\n- Implement mandatory multi-party code review and signing requirements before any crate owner can publish updates to popular packages.\n- Enforce hardware security keys (FIDO2\u002Fpasskeys) for all accounts with publishing rights to crates.io to reduce risk of credential theft via social engineering.\n- Conduct regular tabletop exercises simulating social engineering scenarios targeting open-source maintainers.\n\n**Detection measures:**\n- Monitor crates.io publishing activity for anomalous releases (unexpected timing, version bumps, or new maintainer additions) and alert maintainers automatically.\n- Enable audit logging for all privileged actions on project infrastructure and route alerts to a security operations function for review.",[12,13,14,15,16,17,18,19,20],"CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-50: Building an Information Technology Security Awareness and Training Program","NIST CSF ID.SC-3: Suppliers and third-party partners are identified","NIST CSF PR.AT-1: All users are informed and trained","SLSA Supply Chain Levels for Software Artifacts (Level 3+)","OpenSSF Scorecard: Two-party code review requirement","ITIL Service Management: Change Control Process",{},"published","2026-09-21T12:20:24.329294+00:00","2026-09-21T12:20:23.988+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.securityweek.com\u002Frust-team-members-and-popular-crate-owners-targeted-via-video-calls\u002F","rust-team-members-and-popular-crate-owners-targeted-via-video-calls-5cb8b0","Rust Team Members and Popular Crate Owners Targeted via Video Calls",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[43],{"id":44,"date":45,"edition":46,"title":47,"audio_url":48},"cfbb6e88-6c52-4e82-9727-1068c8a790a0","2026-09-21","afternoon","ThreatNoir Afternoon Brief — September 21","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-21\u002Fthreatnoir-afternoon-brief-2026-09-21.mp3",[50,54,58],{"slug":51,"name":52,"problem":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":55,"name":56,"problem":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":59,"name":60,"problem":61},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]