Cyber Security

Hackers Turning to ‘Exotic’ Programming Languages for Malware Development

Threat actors are increasingly shifting to “exotic” programming languages such as Go, Rust, Nim, and Dlang that can better circumvent conventional security protections, evade analysis, and hamper reverse engineering efforts.

“Malware authors are known for their ability to adapt and modify their skills and behaviors to take advantage of newer technologies,” said Eric Milam, Vice President of threat research at BlackBerry. “That tactic has multiple benefits from the development cycle and inherent lack of coverage from protective products.”

On the one hand, languages like Rust are more secure as they offer guarantees like memory-safe programming, but they can also be a double-edged sword when malware engineers abuse the same features designed to offer increased safeguards to their advantage, thereby making malware less susceptible to exploitation and thwart attempts to activate a kill-switch and render them powerless.

Stack Overflow Teams

Noting that binaries written in these languages can appear more complex, convoluted, and tedious when disassembled, the researchers said the pivot adds additional layers of obfuscation, simply by virtue of them being relatively new, leading to a scenario where older malware developed using traditional languages like C++ and C# are being actively retooled with droppers and loaders written in uncommon alternatives to evade detection by endpoint security systems.

Earlier this year, enterprise security firm Proofpoint discovered new malware written in Nim (NimzaLoader) and Rust (RustyBuer) that it said were being used in active campaigns to distribute and deploy Cobalt Strike and ransomware strains via social engineering campaigns. In a similar vein, CrowdStrike last month observed a ransomware sample that borrowed implementations from previous HelloKitty and FiveHands variants, while using a Golang packer to encrypt its main C++-based payload.

Enterprise Password Management

Some of the prominent examples of malware written in these languages over the past decade are as follows –

  • Dlang – DShell, Vovalex, OutCrypt, RemcosRAT
  • Go – ElectroRAT, EKANS (aka Snake), Zebrocy, WellMess, ChaChi
  • Nim – NimzaLoader, Zebrocy, DeroHE, Nim-based Cobalt Strike loaders
  • Rust – Convuster Adware, RustyBuer, TeleBots Downloader and Backdoor, NanoCore Dropper, PyOxidizer

“Programs written using the same malicious techniques but in a new language are not usually detected at the same rate as those written in a more mature language,” BlackBerry researchers concluded.

“The loaders, droppers and wrappers […] are in many cases simply altering the first stage of the infection process rather than changing the core components of the campaign. This is the latest in threat actors moving the line just outside of the range of security software in a way that might not trigger on later stages of the original campaign.”

Articles You May Like

Satellites and Space Junk May Make Dark Night Skies Brighter, Hindering Astronomy and Hiding Stars From Our View
Apple to Invest $1 Billion A Year on Theatrical Film Releases: Report
The crypto exchange this 26-year-old launched in 2019 has done $1.75 billion in transactions
Huawei FreeBuds 2 Pro+, Huawei FreeBuds 5, and TalkBand B7 With Bluetooth Calling Launched: Details
New ‘Bad Magic’ Cyber Threat Disrupt Ukraine’s Key Sectors Amid War