botking Propose Change

Actor(s): STARDUST CHOLLIMA

According to Wiz Research, botking is a cross-platform backdoor written in Rust, distributed in August 2026 through a supply-chain attack on the arrayref, internment and append-only-vec crates. The attackers added a typosquatted proc-macro1 dependency whose build script executes the payload at compile time. The implant beacons to C2 via HTTPS POST and enumerates saved logins in Chrome, Brave and Edge profiles. Persistence is via a systemd user service, macOS LaunchAgent or Registry Run key. If the primary C2 is unreachable, a fallback DGA generates ten .com domains every five days. Wiz notes significant infrastructure overlap with DPRK-linked supply-chain campaigns.

References

There is no Yara-Signature yet.