Buer Malware Variant Rewritten in Rust Programming Language

Researchers suggest a few reasons why operators rewrote Buer in an entirely new language

Security researchers have identified a new variant of the Buer malware loader rewritten in Rust, a significant change from the C programming language and sign of a growing trend, they report.
Buer, which the Proofpoint team first observed in 2019, is a downloader used to gain a foothold into compromised networks to distribute other malware. RustyBuer, this new variant, is being used in campaigns that spread emails disguised to come from DHL support. Emails contain a link to a malicious Microsoft Word or Excel document, which uses macros to drop the malware.
It is unusual to see common malware written in a completely different way, the team states in a blog post on their findings. While the Buer and RustyBuer attacks use similar email lures, the RustyBuer attachments have more detailed content to better engage the victim, they say.
While its unclear why Buer operators took the time to write the malware in a new language, researchers suggest two likely reasons. For one, Rust is an increasingly popular programming language that is both more efficient and has a broader feature set than C. Further, writing the malware in Rust can help attackers bypass existing Buer detections based on the C language. The new malware variant should remain compatible with existing Buer backend C2 servers.
The rewritten malware, and the use of newer lures attempting to appear more legitimate, suggest threat actors leveraging RustyBuer are evolving techniques in multiple ways to both evade detection and attempt to increase successful click rates, researchers state.
Read the full
Proofpoint blog post
for more details.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Buer Malware Variant Rewritten in Rust Programming Language