The Rust project has reported that attackers are targeting community members and package owners through fake interviews to compromise devices and spread malware. In a blog post by the Rust team, security engineer Adam Harvey noted that the attack tactics resemble those used in North Korean recruiter scams. "A video call is set up for something positive– maybe for a job, maybe for a project, maybe for a contract opportunity, and then used as a vector to get the target to install something on their computer or execute another command,"– Harvey wrote.
The reminder of the risks came amid several attacks on the Rust community that occurred over the summer. In June, Rust developers faced fake interview offers allegedly from a venture capital company in Singapore. Matt Mastracci, who maintains packages on the crates.io registry, shared that the company providing these offers turned out to be inactive, but the initial approach seemed convincing and nearly led to his device being infected with a remote access trojan.
The attempt to deploy a RAT resembles activity reported in an international alert issued last week by agencies from Australia, Germany, Japan, and the U.S. This alert claims that North Korean operators used fake interviews to compromise over 30,000 devices and steal more than $10 million. Separately, the Rust package ecosystem also faced a supply chain attack in August when duplicate versions of the arrayref package were published and downloaded malware onto users' devices. The arrayref package has been downloaded 245 million times in its history, although the malicious releases were available for less than two hours. Evidence suggests that the credentials of one of the supporting developers were compromised, rather than the malware being intentionally introduced by project developers. Harvey urged Rust community members to scrutinize unsolicited approaches, even if the sender appears legitimate, and to conduct calls through trusted platforms.
Related articles
