‘Highly Competitive’ Buer Loader Emerges in Underground Markets

mood · Dec 5, 2019

‘Highly Competitive’ Buer Loader Emerges in Underground Markets
A previously undocumented loader has been discovered in several recent malware campaigns
December 4, 2019
https://threatpost.com/buer-loader-underground-markets/150807/

A previously undocumented modular loader has emerged as a lucrative tool for cybercriminals in a variety of campaigns. Researchers say the “highly competitive” loader, dubbed Buer, is intended for use by actors seeking a turn-key, off-the-shelf solution.

Researchers say they have spotted the loader being actively sold in prominent underground marketplaces since August 2019. Consequently, Buer has made an appearance in several malicious email campaigns and via exploit kits, to then download various strains of malware – from the TrickBot banking trojan to the KPOT information stealer.

“The new loader has robust geotargeting, system profiling and anti-analysis features and is currently being marketed on underground forums with value-added setup services,” said researchers with Proofpoint on Wednesday.
Researchers warn that going forward, Buer’s author is constantly changing the loader, making it a fast-developing threat ripe for future use.
Click to expand...

Proofpoint: Buer, a new loader emerges in the underground marketplace

Minimalist · Oct 28, 2020

The world of malware has a new rising star - and that's a big problem

A new malware-as-a-service offering has been discovered by cybersecurity firm Sophos, providing an alternative to other well-known malware loaders like Emotet and BazarLoader. Buer, as the new malware has been dubbed, was first discovered in August 2019, when it was used to compromise Windows PCs, acting as a gateway for further attacks to follow.
Click to expand...

https://www.techradar.com/news/the-world-of-malware-has-a-new-rising-star-and-thats-a-problem

mood · May 3, 2021

Buer Dropper Malware Updated Using Rust
Proofpoint: New Code Makes 'RustyBuer' Version Harder to Detect
May 3, 2021
https://www.databreachtoday.com/buer-dropper-malware-updated-using-rust-a-16512

Attackers are using a freshly updated variant of the Buer first-stage malware loader rewritten in the Rust programming language to help evade detection, the security firm Proofpoint reports.

"The new strain is completely rewritten in a coding language called Rust, a departure from the previous C programming language. It is unusual to see common malware written in a completely different way," the researchers say.
Due to its efficiency and broad feature set, Rust is becoming a widely used programming language. By using this language, RustyBuer can better evade existing Buer detection capabilities, Proofpoint says.

Proofpoint recently detected emails with RustyBuer targeting over 200 organizations in 50 industries. The attackers are using the malware to establish a beachhead inside a system, and in some cases, these attackers then opt to sell this access to others who go on to implant additional malware, including Cobalt Strike and ransomware, Proofpoint says.
Click to expand...

Proofpoint: New Variant of Buer Loader Written in Rust

Key Findings

The new Buer variant is written in Rust, an efficient and easy-to-use programming language that is becoming increasingly popular. Proofpoint is calling this variant RustyBuer.

Rewriting the malware in Rust enables the threat actor to better evade existing Buer detection capabilities.

Proofpoint observed RustyBuer campaigns delivering Cobalt Strike Beacon as a second-stage payload in some campaigns.

Researchers assess some threat actors may be establishing a foothold with the Buer loader to then sell access to other threat actors. This is known as “access-as-a-service.”

Click to expand...

Log in or Sign up

‘Highly Competitive’ Buer Loader Emerges in Underground Markets

mood Updates Team

Minimalist Registered Member

mood Updates Team