Buer Malware Variant Rewritten in Rust Programming LanguageBuer Malware Variant Rewritten in Rust Programming Language
Researchers suggest a few reasons why operators rewrote Buer in an entirely new language
May 4, 2021
Security researchers have identified a new variant of the Buer malware loader rewritten in Rust, a significant change from the C programming language and sign of a growing trend, they report.
Buer, which the Proofpoint team first observed in 2019, is a downloader used to gain a foothold into compromised networks to distribute other malware. "RustyBuer," this new variant, is being used in campaigns that spread emails disguised to come from DHL support. Emails contain a link to a malicious Microsoft Word or Excel document, which uses macros to drop the malware.
"It is unusual to see common malware written in a completely different way," the team states in a blog post on their findings. While the Buer and RustyBuer attacks use similar email lures, the RustyBuer attachments have more detailed content to better engage the victim, they say.
While it's unclear why Buer operators took the time to write the malware in a new language, researchers suggest two likely reasons. For one, Rust is an increasingly popular programming language that is both more efficient and has a broader feature set than C. Further, writing the malware in Rust can help attackers bypass existing Buer detections based on the C language. The new malware variant should remain compatible with existing Buer backend C2 servers.
"The rewritten malware, and the use of newer lures attempting to appear more legitimate, suggest threat actors leveraging RustyBuer are evolving techniques in multiple ways to both evade detection and attempt to increase successful click rates," researchers state.
Read the full Proofpoint blog post for more details.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023