RustyBuer, a Reworked Version of the Buer Trojan
The Buer downloader is a dangerous Trojan whose activity dates back to the end of 2020. Its creators use it to propagate different pieces of malware such as banking Trojans, ransomware, and information stealer. Recently, cybersecurity experts came across a new variant of this threat. The malware appears to pack almost identical functionality, but there is one major difference – the software was written in Rust instead of C. Rust is a relatively new programming language, and cybercriminals are exploring it because there is a chance that antivirus products are not yet used to it. The situation is the same about the Golang language – it becomes more and more common in new malware developments.
RustyBuer Malware, a Revamped Version of the Buer Trojan
So, how does the RustyBuer Malware reach its victims? The criminals are delivering the malicious file via spear-phishing emails, which contain either an attachment or a download link to an external source. In both situations, victims end up downloading a Microsoft Office document, typically using the DOCX or XLSX format.
When they try to open the document, however, they may see a prompt asking them to enable macros. They will also notice a decoy document, which claims to be verified by a wide range of popular antivirus tools. This is a common trick that cybercriminals use to make their macro-laced documents appear more legitimate. If the user ends up enabling macros, the malicious file will use a hidden script to deploy and initialize the RustyBuer Malware payload.
So far, almost all copies of the RustyBuer Malware have been delivering a copy of the Cobalt Strike Beacon. This is a legitimate penetration-testing tool that, unfortunately, cybercriminals misuse. The gang behind the Buer and RustyBuer Malware attacks is not yet identified, but researchers suspect that they might be operating out of Russia.
The number of malware developers relying on more 'exotic' programming languages continues to grow. Prior to the RustyBuer Malware reports, antivirus vendors worldwide had to tackle Golang-based threats like the ChaChi Trojan and the Klingon RAT.
