Malware

New Rust-based Backdoor Attacking Windows and Linux Systems

Rust’s strong focus on memory safety, which prevents common vulnerabilities such as buffer overflows, makes it a choice for threat actors to use Rust-based backdoors. Moreover, the performance of this language is appealing to many, and due to this, they prefer using it when creating malware that is...

S ShomoySoft Editorial

· Aug 25, 2025 · 4 min read · 👁 0 views

New Rust-based Backdoor Attacking Windows and Linux Systems

Rust’s strong focus on memory safety, which prevents common vulnerabilities such as buffer overflows, makes it a choice for threat actors to use Rust-based backdoors.

Moreover, the performance of this language is appealing to many, and due to this, they prefer using it when creating malware that is both efficient and stealthy.

Not only that, but its quick attack development and support are also well-backed by its community.

Cybersecurity researchers at PolySwarm recently discovered a new rust-based backdoor, KrustyLoader, that is actively attacking Windows andLinux operating systems.

Technical analysis

The cross-platform capabilities of KrustyLoader have recently been highlighted in industry reports targeting Linux and Windows systems.

Document

Are you from SOC and DFIR teams? – Join With 400,000 independent Researchers

Malware analysis can be fast and simple. Just let us show you the way to:

Interact with malware safely
Set up virtual machine in Linux and all Windows OS versions
Work in a team
Get detailed reports with maximum data

The fame of the Linux version of KrustyLoader, which appeared towards the end of 2023 to early 2024 directly on Avanti devices, has been blamed on the Chinese-affiliated hacking collective called “UNC5221.”

UNC5221 (aka UTA0178), a China-linkedgroup, mainly focuses on targeted espionage rather than opportunistic attacks.

However, there is limited info available at the moment, but they employ various malware like:-

CHAINLINE
FRAMESTING
WIREFIRE
LIGHTWIRE
BUSHWALK
WARPWIRE
ZIPLINE

Moreover, there is some evidence that attackers were exploiting ScreenConnect and opted to use it in carrying out their malicious activities using a Windows variant of KrustyLoader.

Exploiting CVE-2024-21887 and CVE-2023-46805, they targeted Ivanti Connect Secure and Policy Secure Gateway.

Rust payloads deployed KrustyLoader, which fetched the post-exploitation tool Sliver.

Although they were patched, the unsecured systems remain vulnerable.

Cybersecurity analysts at WithSecure detected threat actors hijacking ScreenConnect, deploying KrustyLoader’s Windows form.

This Rust-based malware is similar to its Linux cousin that fetches and fires up a secondary payload, frequently called “Sliver.”

In two directories on the compromised system, the threat actors plant r.bat which is a batch file. This script deletes the previous payloads, fetches a random URL hosting KrustyLoader from AWS S3, and then it saves as 1.exe and executes it.