Malicious Code Published to Compromised Rust Crates in Supply-Chain Attack

Summary

Threat Wire reports malicious Rust crates distributed through a compromised maintainer repository, a patched arbitrary-file disclosure flaw in Record Box, and attacks disrupting water utilities and a British power plant.

Key points

The video says attackers compromised a maintainer’s GitHub repository and published malicious code to multiple Rust crates; a typo-squatted dependency ran during compilation and selected a payload for the host operating system.
The malware queried SQLite login databases to seek credentials from Chrome, Brave, and Edge.
The Rust supply-chain incident was reportedly live and resolved within about two hours. Whiz noted overlap with other attacks attributed to North Korean hackers.
A flaw in Record Box’s NFS server allowed a device on the same Wi-Fi network to download arbitrary files when the relevant mode was enabled. Alpha Theta released a patch; the video says the software was affected on Mac, Windows, iOS, and Android.
The video reports that Microsoft Teams introduced a feature to block identified external bots from meetings, and that GitLab flaws allowed unauthenticated modification or deletion of public projects and user data.
Water-system attacks were reported across 12 states, with nine states confirmed; in Georgia, attackers shut down a pump station, prompting a countywide boil-water advisory.
A British power plant was reportedly offline for four days. The video links the utilities attacks to Iranian attackers, while noting British officials disclosed few details.

Article Details

Topics: [00:20] Malicious Rust crate publications following compromise of a maintainer repository
[01:14] Record Box NFS arbitrary-file disclosure vulnerability and patch
[02:10] Microsoft Teams external-bot blocking, GitHub outage, and GitLab vulnerabilities
[02:52] Reported attacks on water systems and operational disruption
[03:35] British power plant outage and reported attribution to Iranian attackers

MITRE ATT&CK

T1195.001 · Compromise Software Dependencies and Development ToolsThe video describes malicious code published to Rust crates after compromise of a maintainer’s repository, with a typo-squatted dependency executing during compilation.T1555.003 · Credentials from Web BrowsersThe malware reportedly queried browser SQLite login databases to seek credentials from Chrome, Brave, and Edge.

Vendors

Alpha Theta[02:02] vulnerability. Alpha Theta, the maker of GitHub[00:30] GitHub repo of the maintainer. The GitLab[02:25] hand, new CVEEs were found in GitLab Microsoft[02:10] Microsoft has enabled a new feature on

Products

Brave[00:48] Chrome, Brave, and Edge by querying the Edge[00:48] Chrome, Brave, and Edge by querying the GitHub[00:30] GitHub repo of the maintainer. The GitLab[02:25] hand, new CVEEs were found in GitLab Google Chrome[00:48] Chrome, Brave, and Edge by querying the Pro DJ Link[01:24] compatible with the pro DJ link Record Box[01:21] vulnerability existed in record box