Speaking Hacker: The ‘Unique’ Programming Languages of Malware Developers

Threat actors and malicious hackers have continually been creating malware in several ‘unique’ programming languages to help circumvent & evade security protections and analysis, which can severely impact the ability to reverse engineer the malware.

Malware developers are constantly improving their skills, adapting, and modifying their techniques and abilities to take advantage of newer technologies, and those corporations who are slow to adapt. This give malware developers the ability to leverage lesser-known techniques which many products are unfamiliar with. This gives malware developers an ‘edge’ in terms of being able to find a target, and successfully penetrate their network security and internal data.

What Programming Languages do Malware Developers Use?

The latest programming languages that malware authors are using are Dlang, Rust, Go, and Nim. Rust is a programming language that guarantees such as memory-safe programming, though malware developers are using the same features to their advantage. In the case of an effective malware written in Rust, the malware can end up being less exploitable and makes the corporation unable to active any kill-switch to force the hacker out of the network, making the organization or corporations security protocols fail entirely.

As binaries written in these languages appear complex and tedious, the adaption to using these languages gives malware developers a layer of obfuscation as they are so new and uncommon. This allows malware developed in common languages like C# and C++ to be reengineered, evading detection by endpoint security systems of an organization.

The latest malware attacks leveraging these unique languages happened earlier this year in 2021, with malware being written with Rust and Nim. The malware was used to distribute Cobalt strike and other ransomware into a social engineering campaign. These malicious attacks were able to slip-by for longer duration of time compared to malwares written in matured, common programming languages.

CrowdStrike, a cybersecurity company also noted recently that a ransomware sample was using implementations from older ransomware variants, HelloKitty and FiveHands, while also using a Goland packer to encrypt its C++ based payload, which was undetected for several months.

Protect your organization, business and network security with Integrated Computer Services based in New Jersey. To learn more or to protect your network infrastructure, give us a call today!