Loading threat actor…
Ablerust is the alias associated with a 2025 open-source supply-chain campaign involving malicious Rust packages published to the crates.io ecosystem. The actor used cryptocurrency-themed package branding to masquerade as legitimate Ethereum Virtual Machine and Uniswap-related developer tooling, indicating a focus on Web3 developers and downstream users of those dependencies. The operation relied on a staged infection chain in which a seemingly benign function triggered retrieval and execution of a second-stage payload across Windows, macOS, and Linux, and a related package caused the malicious code to run automatically during initialization, increasing exposure through transitive dependency abuse. The actor demonstrated cross-platform initial access through software supply-chain compromise, defense evasion through obfuscation and conditional execution, and post-compromise payload delivery tailored to the victim environment. Reported tradecraft included embedding malicious logic inside an innocuous helper function, using encoded strings to conceal infrastructure, accepting invalid TLS certificates, and altering execution flow on Windows based on the presence of Qihoo 360 security software. The campaign used command interpreters and platform-native scripting mechanisms to launch follow-on payloads. Targeting patterns indicate a likely emphasis on cryptocurrency theft, with lures centered on Ethereum and Uniswap development workflows and environmental checks suggesting attention to Chinese-speaking or Asia-based victims. High-confidence reporting supports characterization of the activity as financially motivated rather than espionage-oriented. No verified nation-state attribution is established for ablerust.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ablerust is responsible for a supply chain attack targeting developers in the Web3 space by publishing malicious Rust packages ('evm-units' and 'uniswap-utils') to crates.io. The packages masquerade as Ethereum-related utilities and deliver OS-specific payloads to steal cryptocurrency or gain control of developer machines.
ablerust is responsible for a supply chain attack involving the publication of a malicious Rust package (evm-units) and its integration into another package (uniswap-utils). The attack targets cryptocurrency users and developers, likely aiming to steal cryptocurrency by deploying OS-specific payloads that execute silently on Linux, macOS, and Windows. The malware is designed to evade detection, particularly focusing on systems in Asian markets by checking for Qihoo360 antivirus.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.