Sapphire Sleet
Tracked by CyberSIXT since 1 Apr
- Articlesall time
- 8
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
10 articles from 5 outlets since 28 Oct 2025; the latest 66 days ago.
- Article
- First report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Malpedia lists Sapphire Sleet under the alias STARDUST CHOLLIMA2. SecurityWeek describes Sapphire Sleet as a North Korean threat actor1.
SecurityWeek attributed a supply chain attack targeting the Rust ecosystem to Sapphire Sleet, reporting that arrayref@0.3.10 contained code to fetch a harmful binary and was published from the original maintainer’s account1. SecurityWeek also linked other compromised crates to the attack and reported that the Rust Security Response Team removed the malicious packages1. SecurityWeek reported no evidence of exploitation and said the original author was likely compromised1. SecurityWeek also attributed earlier supply chain attacks on the NPM registry to Sapphire Sleet1.
Sources
- North Korean hackers breach Rust supply chain via crate arrayref · SecurityWeek · 2026-08-21
- Sapphire Sleet: alias · Malpedia
Diamond Model
What the record links to Sapphire SleetRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- STARDUST CHOLLIMA
- CyberSIXT coverage, Malpedia, MISP Galaxy
- Sapphire Sleet
- Malpedia, MISP Galaxy
MITRE ATT&CK® techniques
115 techniques · 13 tacticsFrom MITRE ATT&CK® · G0082
Resource Development 10
Initial Access 7
Execution 15
- T1053.003
- Cron
- T1053.005
- Scheduled Task
- T1053.006
- Systemd Timers
- T1059.001
- PowerShell
- T1059.002
- AppleScript
- T1059.003
- Windows Command Shell
- T1059.004
- Unix Shell
- T1059.005
- Visual Basic
- T1059.006
- Python
- T1059.007
- JavaScript
- T1106
- Native API
- T1204.001
- Malicious Link
- T1204.002
- Malicious File
- T1569.002
- Service Execution
- T1677
- Poisoned Pipeline Execution
Persistence 12
Privilege Escalation 14
- T1053.003
- Cron
- T1053.005
- Scheduled Task
- T1053.006
- Systemd Timers
- T1055
- Process Injection
- T1078.003
- Local Accounts
- T1078.004
- Cloud Accounts
- T1543.001
- Launch Agent
- T1543.003
- Windows Service
- T1543.004
- Launch Daemon
- T1546.016
- Installer Packages
- T1547.001
- Registry Run Keys / Startup Folder
- T1548.002
- Bypass User Account Control
- T1548.003
- Sudo and Sudo Caching
- T1548.006
- TCC Manipulation
Stealth 27
- T1027.002
- Software Packing
- T1027.010
- Command Obfuscation
- T1027.015
- Compression
- T1027.016
- Junk Code Insertion
- T1036.003
- Rename Legitimate Utilities
- T1036.005
- Match Legitimate Resource Name or Location
- T1036.006
- Space after Filename
- T1036.008
- Masquerade File Type
- T1055
- Process Injection
- T1070.003
- Clear Command History
- T1070.004
- File Deletion
- T1070.006
- Timestomp
- T1078.003
- Local Accounts
- T1078.004
- Cloud Accounts
- T1140
- Deobfuscate/Decode Files or Information
- T1218.001
- Compiled HTML File
- T1218.005
- Mshta
- T1218.007
- Msiexec
- T1218.011
- Rundll32
- T1480
- Execution Guardrails
- T1480.002
- Mutual Exclusion
- T1564.003
- Hidden Window
- T1564.011
- Ignore Process Interrupts
- T1564.012
- File/Path Exclusions
- T1620
- Reflective Code Loading
- T1678
- Delay Execution
- T1684.001
- Impersonation
Defense Impairment 9
Credential Access 8
Discovery 11
- T1012
- Query Registry
- T1033
- System Owner/User Discovery
- T1049
- System Network Connections Discovery
- T1057
- Process Discovery
- T1082
- System Information Discovery
- T1083
- File and Directory Discovery
- T1124
- System Time Discovery
- T1135
- Network Share Discovery
- T1217
- Browser Information Discovery
- T1518
- Software Discovery
- T1518.001
- Security Software Discovery
Collection 8
Command and Control 4
Exfiltration 3
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- North Korean hackers breach Rust supply chain via crate arrayrefSecurityWeek
- North Korean Hackers Hijack NPM Packages via Social EngineeringSecurityOnline
- UK Education Dept Breach Exposes 607k Records After NPM AttackSecurityWeek
- North Korea's Sapphire Sleet hijacks npm packages via Amazon linksThe Hacker News
- North Korean hackers breach Mastra via tainted npm packagesInfosecurity
- North Korean Group Targets NPM Supply Chain, 8M Devs at RiskSecurityWeek
- North Korean hackers use AppleScript, ClickFix on macOS financeSecurityWeek
- Mitigating the Axios npm supply chain compromiseMicrosoft
- BlueNoroff APT Launches AI-Enhanced Espionage on macOS, Using GPT-4o Images in Fake GhostCall MeetingsSecurityOnline
- BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration MethodsGBHackers · first in our coverage