Hackers Are Now Using Rust to Build Malware

A cyber espionage group is using a new trojan written in Rust, making it harder for security teams to detect and analyze.

A cyberespionage group known as Bitter is actively targeting organizations in South Asia with a newly discovered malware. According to a report from Fortinet FortiGuard Labs, the group is deploying a previously undocumented remote access trojan (RAT) named PapRAT. This tool is part of a targeted campaign designed for long-term espionage, giving attackers persistent control over compromised systems to execute commands and exfiltrate files. The discovery highlights the continued evolution of Bitter, an established advanced persistent threat (APT) group also known as T-APT-17 and Hazy Tiger. This campaign underscores the ongoing cyber threats faced by government and private sector entities as sophisticated adversaries constantly refine their toolsets to achieve their strategic goals.

The most significant aspect of PapRAT is its implementation in two different programming languages: C++ and Rust. While C++ is a conventional choice for malware development, the creation of a Rust-based variant is a notable development. Researchers observed that both versions provide similar core functions, such as remote command execution and file system manipulation. However, the Rust version leverages the language's modern features, including memory safety and robust concurrency handling. These characteristics can make the resulting malware more stable, less prone to crashing, and significantly more difficult for security analysts to reverse-engineer. This dual-language strategy suggests the threat actors are actively experimenting with newer technologies to enhance their operational effectiveness and bypass security defenses that are primarily tuned to detect patterns in traditional C and C++ malware.

The use of Rust for malware is part of a broader trend among sophisticated threat actors. In recent years, attackers have increasingly adopted what were once considered unconventional languages, including Go, Nim, and D, alongside Rust. These modern languages offer several tactical advantages. Many provide easy cross-compilation, enabling attackers to create malware that can run on Windows, macOS, and Linux from a single codebase. Furthermore, the binaries they produce often lack the well-documented signatures and structures that security tools are trained to recognize. Because the cybersecurity industry has decades of experience analyzing C-based malware, the shift to newer languages creates a knowledge gap that attackers are keen to exploit. This strategic pivot forces defenders to adapt to a new class of threats that look and behave differently from their predecessors.

The emergence of PapRAT, especially its Rust variant, is a clear signal for security teams to evolve their detection and response strategies. Relying solely on signature-based tools and heuristics designed for legacy malware is no longer a viable defense. Organizations must invest in developing the skills and tooling needed to analyze binaries written in modern languages. This includes understanding the unique compilation artifacts, library functions, and runtime behaviors associated with Rust applications. More importantly, this trend reinforces the critical need for behavior-based threat detection. Instead of looking for a known bad file, security systems must focus on identifying suspicious activities—such as unusual network connections or unauthorized command execution—regardless of the language used to create the malicious tool. As more threat actors embrace modern programming languages, proactive and adaptive defense will be essential.

The use of Rust for malware bypasses traditional C/C++ memory-based detection methods and lowers the bar for creating complex, cross-platform threats. This trend forces security teams to adapt their analysis tools and techniques for modern programming languages, moving beyond legacy malware signatures.

The adoption of modern languages like Rust by threat actors increases corporate security risk. This new generation of malware can be more stable and evasive, leading to longer dwell times before detection and elevating the potential for significant data breaches and intellectual property theft.