Saturday, May 24, 2025
HomeRansomwareHackers Rewritten The RansomExx Ransomware in Rust Language To Evade Detection

Hackers Rewritten The RansomExx Ransomware in Rust Language To Evade Detection

Published on

SIEM as a Service

Follow Us on Google News

There has recently been a discovery made by IBM Security X-Force Threat Researchers regarding a new variant of ransomware known as RansomExx that is dubbed RansomExx2 which was written in Rust language.

While threat actor behind this malware is known as Hive0091 (aka DefrayX). Apart from this, the RansomExx is also known by following these names:- 

  • Defray777
  • Ransom X

With the release of this new variant, a growing trend has been noticed in which ransomware developers are switching to the Rust programming language, which has become a common programming language for threat actors.

- Advertisement - Google News

“If the Rust language continues to be adopted by malware developers, then this will eventually change as AV vendors will start increasing their abilities to detect it, so its advantages compared to other languages will lessen. At that point, we may see malware developers shift and experiment with different languages instead,”. IBM researchers said.

Technical Analysis

The primary reason for using Rust may have been its ability to offer lower detection rates for anti-virus programs. As a result of this growing trend, it is following the same patterns as strains such as:-

  • BlackCat
  • Hive
  • Luna

DefrayX (aka Hive0091) threat actor group is also known for the following strains:-

  • PyXie malware
  • Vatet loader
  • Defray ransomware

A wide variety of ransomware has previously been released by this group, including versions for Linux and Windows. That’s why there is a good possibility that the Windows version of the ransomware will also be released soon.

Though the new variant RansomExx2 has been molded in the Rust programming language, but it still maintains much of its functionality as its predecessor.

Several parameters will need to be passed to RansomExx2 as part of its command line arguments to encrypt the target directories. Following that, files are encrypted with AES-256, while the encryption keys are protected with RSA cryptography.

There has also been an update to the ransomware group’s website, where now the page title has been changed to:-

  • ransomexx2

When executed, ransomware enumerates and encrypts files in the directories specified by the user. With the exception of ransom notes and previously encrypted files, all files with a size of more than 40 bytes are encrypted.

A new file extension is given to every encrypted file so that it can be recognized easily. In every directory where the encrypted files are located, a ransom note will be dropped.

The ransom note is titled as “!_WHY_FILES_ARE_ENCRYPTED_!.txt” and this note contains the following information:-

There have been a number of victims of RansomExx’s operations since the operation was launched in 2018, including the following:

  • Government agencies
  • GIGABYTE
  • Zegna

There is a high probability that there will be more threats trying out Rust in the future, as determined by X-Force. Among the newest ransomware families to shift to Rust in 2022 is RansomExx.

“Like the Go programming language, which has experienced a similar surge in usage by threat actors over the past few years, Rust’s compilation process also results in more complex binaries that can be more time-consuming to analyze for reverse engineers.”

Managed DDoS Attack Protection for Applications – Download Free Guide

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to...

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code...

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager...

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Inside LockBit: Data Leak Reveals Leading Affiliates and How They Operate

A massive data leak from the LockBit ransomware group, published on its hijacked leak...

Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation

The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov,...

VanHelsing Ransomware Builder Exposed on Hacker Forums

The cybersecurity landscape reveal that the VanHelsing ransomware operation has experienced a significant security...