Buer Malware Variant Rewritten in Rust Programming Language
Researchers suggest a few reasons why operators rewrote Buer in an entirely new language
Security researchers have identified a new variant of the Buer malware loader rewritten in Rust, a significant change from the C programming language and sign of a growing trend, they report.
Buer, which the Proofpoint team first observed in 2019, is a downloader used to gain a foothold into compromised networks to distribute other malware. "RustyBuer," this new variant, is being used in campaigns that spread emails disguised to come from DHL support. Emails contain a link to a malicious Microsoft Word or Excel document, which uses macros to drop the malware.
"It is unusual to see common malware written in a completely different way," the team states in a blog post on their findings. While the Buer and RustyBuer attacks use similar email lures, the RustyBuer attachments have more detailed content to better engage the victim, they say.
While it's unclear why Buer operators took the time to write the malware in a new language, researchers suggest two likely reasons. For one, Rust is an increasingly popular programming language that is both more efficient and has a broader feature set than C. Further, writing the malware in Rust can help attackers bypass existing Buer detections based on the C language. The new malware variant should remain compatible with existing Buer backend C2 servers.
"The rewritten malware, and the use of newer lures attempting to appear more legitimate, suggest threat actors leveraging RustyBuer are evolving techniques in multiple ways to both evade detection and attempt to increase successful click rates," researchers state.
Read the full Proofpoint blog post for more details.
About the Author
You May Also Like
A Cyber Pros' Guide to Navigating Emerging Privacy Regulation
Dec 10, 2024Identifying the Cybersecurity Metrics that Actually Matter
Dec 11, 2024The Current State of AI Adoption in Cybersecurity, Including its Opportunities
Dec 12, 2024Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024