Buer Malware Variant Rewritten in Rust Programming Language

  /     /     /  
Publicated : 23/11/2024   Category : security


Buer Malware Variant Rewritten in Rust Programming Language


Researchers suggest a few reasons why operators rewrote Buer in an entirely new language



Security researchers have identified a new variant of the Buer malware loader rewritten in Rust, a significant change from the C programming language and sign of a growing trend, they report.
Buer, which the Proofpoint team first observed in 2019, is a downloader used to gain a foothold into compromised networks to distribute other malware. RustyBuer, this new variant, is being used in campaigns that spread emails disguised to come from DHL support. Emails contain a link to a malicious Microsoft Word or Excel document, which uses macros to drop the malware.
It is unusual to see common malware written in a completely different way, the team states in a blog post on their findings. While the Buer and RustyBuer attacks use similar email lures, the RustyBuer attachments have more detailed content to better engage the victim, they say.
While its unclear why Buer operators took the time to write the malware in a new language, researchers suggest two likely reasons. For one, Rust is an increasingly popular programming language that is both more efficient and has a broader feature set than C. Further, writing the malware in Rust can help attackers bypass existing Buer detections based on the C language. The new malware variant should remain compatible with existing Buer backend C2 servers.
The rewritten malware, and the use of newer lures attempting to appear more legitimate, suggest threat actors leveraging RustyBuer are evolving techniques in multiple ways to both evade detection and attempt to increase successful click rates, researchers state.
Read the full 
Proofpoint blog post
 for more details.

Last News

▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂
Discovered: 23/12/2024
Category: security

▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂
Discovered: 23/12/2024
Category: security

▸ Nigerian scammers now turning into mediocre malware pushers. ◂
Discovered: 23/12/2024
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Buer Malware Variant Rewritten in Rust Programming Language