CosmicRust is a Mach-O malware family written in Rust and associated by the source with TA444, also tracked as Sapphire Sleet or BlueNoroff. It is described as resembling a less mature RustBucket variant, with the notable difference that it uses WebSockets for network communication. The sample identified itself as “bot-client,” used an ad hoc certificate, and reused paths seen in earlier TA444 malware.