Malware makers might have a reputation for being slow to let go of whatever’s working, but they’re happy to pick up new programming languages for the same reasons as their law-abiding counterparts: It helps to rub out pain points in the development cycle, for one. In fact, the use of the legitimate Cobalt Strike security tool has exploded: Its usage in cyberattacks is up 161 percent year-over-year, having gone fully mainstream in the crimeware world. “They have been commonly used to help threat actors evade detection on the endpoint.” “These new first-stage pieces of malware are designed to decode, load, and deploy commodity malware such as the Remcos and NanoCore Remote Access Trojans (RATs), as well as Cobalt Strike,” according to the report. Specifically, researchers are tracking more loaders and droppers being written in rarer languages. “Threat actors have begun to adopt them to rewrite known malware families or create tools for new malware sets.” “These uncommon programming languages are no longer as rarely used as once thought,” according to the writeup.

The team chose those four languages to examine, partly because they fit its detection methodologies, but also since the languages have strong community backing and could be considered more developed. Use of those four languages is escalating in the number of malware families being identified, according to a report published on Monday by BlackBerry Research and Intelligence Team. Malware authors are increasingly using rarely spotted programming languages such as Go, Rust, Nim and DLang in order to create new tools and to hinder analysis, researchers have found.

Compiled programming language list