RayRef
A lightweight crate in the Rust ecosystem that allows slices to be extracted from arrays with the slice length known at compile time, providing compile-time safety checks for Rust programs.
Timeline (last 90 days)
On August 20, 2024, a malicious version 0.3.10 of the popular Rust crate RayRef appeared.
RayRef allows slices to be taken from arrays while knowing the slice length at compile time, providing compile-time safety checks for Rust programs.
At the time of video recording, RayRef had approximately 254 million downloads.
The backdoor assembles a URL from Base64 fragments to conceal the real address, and downloads a platform-specific payload based on the operating system, writing it to the /Temp directory for execution.
The attack achieves persistence via registry key values, with the configuration using the string IMBotKing for symmetric encryption.
All Facts (5)
RayRef allows slices to be taken from arrays while knowing the slice length at compile time, providing compile-time safety checks for Rust programs.
50%UnverifiedAt the time of video recording, RayRef had approximately 254 million downloads.
50%UnverifiedThe backdoor assembles a URL from Base64 fragments to conceal the real address, and downloads a platform-specific payload based on the operating system, writing it to the /Temp directory for execution.
50%UnverifiedThe attack achieves persistence via registry key values, with the configuration using the string IMBotKing for symmetric encryption.
50%UnverifiedOn August 20, 2024, a malicious version 0.3.10 of the popular Rust crate RayRef appeared.
50%