Malware authors are increasingly using rarely spotted programming languages such as Go, Rust, Nim and DLang in order to create new tools and to hinder analysis, researchers have found.
Use of those four languages is escalating in the number of malware families being identified, according to a report published on Monday by BlackBerry Research and Intelligence Team. The team chose those four languages to examine, partly because they fit its detection methodologies, but also since the languages have strong community backing and could be considered more developed.
“These uncommon programming languages are no longer as rarely used as once thought,” according to the writeup. “Threat actors have begun to adopt them to rewrite known malware families or create tools for new malware sets.”
Specifically, researchers are tracking more loaders and droppers being written in rarer languages. “These new first-stage pieces of malware are designed to decode, load, and deploy commodity malware such as the Remcos and NanoCore Remote Access Trojans (RATs), as well as Cobalt Strike,” according to the report. “They have been commonly used to help threat actors evade detection on the endpoint.”
In fact, the use of the legitimate Cobalt Strike security tool has exploded: Its usage in cyberattacks is up 161 percent year-over-year, having gone fully mainstream in the crimeware world.
The Dark Side of Innovation
Malware makers might have a reputation for being slow to let go of whatever’s working, but they’re happy to pick up new programming languages for the same reasons as their law-abiding counterparts: It helps to rub out pain points in the development cycle, for one. Also, from the malware author’s perspective, new languages keep their creations a step – or two, or three – ahead of protection tools. “Malware authors are known for their ability to adapt and modify their skills and behaviors to take advantage of newer technologies,” Eric Milam, vice president of threat research, wrote. “This has multiple benefits from the development cycle and inherent lack of coverage from protective solutions.”
Also, just like non-malware programmers, malware authors need to protect themselves from exploitation. Blackberry pointed to “EmoCrash” as an example of what they’re hardening their defenses to avoid: About a year ago, security researcher James Quinn revealed that he had developed a killswitch – dubbed EmoCrash – that exploited a buffer overflow within the installation routine of the main binary in the infamous Emotet infostealer, causing it to crash and preventing it from infecting systems for six months. In effect, he had concocted an Emotet vaccine.
Cases in Point: APT28’s & APT29’s Growing ‘Go’ Fluency
When it comes to these more obscure languages, malware developers have, historically, mostly written in Go: a general-purpose language that’s much like C++ in that it’s statically typed and compiled. In fact, its compiler was originally written in C, though it’s now also written in Go.
C-language malware is still the most widespread, the researchers said. But two Russia-based threat actors, APT28 and APT29, have begun to use the more exotic languages in malware sets more often than other groups. APT28 is aka Fancy Bear or Strontium, et al., while APT29 is aka Nobelium, Cozy Bear or the Dukes, et al.
Go is now “one of the ‘Go-to’ languages for threat actors” who are cooking up variants, Blackberry researchers said, both at the level of advanced persistent threat (APT) and commodity level. “New Go-based samples are now appearing on a semi-regular basis, including malware of all types, and targeting all major operating systems across multiple campaigns,” they wrote.
APT28 and APT29 are good examples. APT28, infamous for its alleged meddling in the 2016 presidential election via infiltration of the Democratic National Committee, is linked to a wide range of attacks and malware families, but the Zebrocy malware family in particular “notably uses multiple uncommon programming languages within its kill chain,” according to the report.
Zebrocy, aka Sednit, APT28, Fancy Bear and Strontium and used by the threat group Sofacy, operates as a downloader and collects data about infected hosts.
As researchers explained, when Zebrocy samples were first seen in 2015, they had three parts: a Delphi downloader, an AutoIT downloader and a Delphi backdoor. Regardless of which language Zebrocy is written in, it spreads via phishing campaigns that contain an initial trojan that tries to communicate with a command-and-control (C2) server and which executes a downloader to drop a malicious payload via an established backdoor. It’s been rewritten multiple times, but “the method of delivery via email attachment and general functionality remains largely the same,” the report said.
A selection of Go rewrites used by APT28:
For its part, APT29/Cozy Bear, best known for its part in the SolarWinds supply-chain attacks of early 2020, was targeting Windows and Linux machines in 2018 with WellMess, a remote access trojan (RAT) written in Go and .NET.
The researchers noted that the most prevalent variant of WellMess is the Go version, which comes in both 32-bit and 64-bit variants as PE and ELF files, “giving APT29 the ability to deploy it to more than one type of architecture and OS.”
APT29 typically penetrates a victim’s network by first scanning an organization’s external IP addresses for vulnerabilities and then throwing public exploits against vulnerable systems
The group’s growing use of Go variants includes using more sophisticated WellMess variants in 2020 attempts to steal COVID-19 vaccine research from academic and pharmaceutical research institutions in various countries around the world, including the U.S., the U.K. and Canada. The researchers noted that the newer variant, while written in Go, has been made more complicated: APT29 has, for example, added more network communication protocols and the ability to run PowerShell scripts post-infection.
“Both threat actors are still active and have conducted some of the most impactful Russian cyberattacks to date,” Blackberry researchers asserted. “Recent activity suggests that these groups have been using the uncommon programming languages mentioned in this paper to add complexity to their malware, target multiple platforms, and evade detection.”
Beyond Go and its growing attraction to APT28 and APT29, other rare languages over the past decade have increasingly been used in ever more malware families by additional threat actors. Below is a timeline of how the four languages have increasingly cropped up, particularly the languages Rust, Nim, and D. Blackberry analysts noted that it’s not an exhaustive list of the malware families that have been developed in these languages.
Timeline of prominent examples of malware written in the languages of Go, Rust, Nim, and DLang. Source: Blackberry.
DLang malware appears to be the least favorite language in the evolving threat landscape, but it has seen some modest growth over the last year. This could mark a trend for more pervasive DLang adoption by malware developers, the report predicted.
There’s nothing modest about the big uptick in use of initial stagers for Cobalt Strike being compiled using Go, and more recently in Nim, according to the writeup, initial stagers being the binary used to facilitate first-stage, initial access by reaching out to download the Cobalt Strike beacon from a TeamServer. “This server is responsible for serving the beacons themselves,” according to the report. “It is important that defenders stay ahead of the curve in catching Cobalt Strike-related files written in these languages, to enhance defensive capability against such a formidable threat.”
Noise From the Tower of Babel Helps Attackers
Blackberry’s team delineated a number of reasons why using less common languages helps attackers do their dirty deeds:
Alternatively, threat actors with deep resources are completely rewriting existing malware in new languages, as opposed to just wrappers and loaders. Examples: BazaLoader switched to NimzaLoader, while Buer switched to RustyBuer.
Fighting Back
Blackberry suggested that in order to catch these multi-language malware families, software engineers and threat researchers will stand a better chance if they employ dynamic or behavioral signatures, signatures that tag behavior via sandbox output, or endpoint detection and response (EDR), or log data. “These techniques can be far more reliable in these instances,” according to the report.
Employing implementation-agnostic detection rules in order to tag dynamic behaviors can help if static signatures fail, researchers said, given that malware often behaves in the same way, especially when the malware is recoded. “In other circumstances such as shellcode loaders, which often inject into processes using a limited subset of Windows API calls, they can be identified using that limited subset,” the report elucidated.
As well, the use of libraries within a binary can often be “signaturized,” researchers said. “The languages investigated in this report have bindings which allow them to interface with the Win32 API and use these API calls. In essence, they can use an almost-identical methodology to that of more traditional languages such as C++. This is not always the case, as particular languages can use their own APIs in place of Win32 APIs. For example, they could use cryptographic libraries that would restrict the visibility of certain events. However, the use of these libraries within a binary can often be ‘signaturized’ too.”
It’s going to take a while for malware sample analysis tools to catch up to these new languages, but it’s “imperative” for the security community to “stay proactive in defending against the malicious use of emerging technologies and techniques,” Blackberry warned.
“It is critical that industry and customers understand and keep tabs on these trends, as they are only going to increase,” Blackberry’s Milam advised.
Check out our free upcoming live and on-demand webinar events – unique, dynamic discussions with cybersecurity experts and the Threatpost community.