Decoder Loop

Excited to announce: @cxiao@infosec.exchange will be speaking at @rustconf@hachyderm.io in Montréal this year, with the talk "Reverse Engineering Rust Malware in 2026"! https://sched.co/2KHt7

The widespread adoption of Rust has not only led to an increase in legitimate Rust software, but also an explosion in malware written in Rust. How are malware reverse engineers tackling Rust malware, in 2026?

The talk will walk through the analysis of a Rust malware sample, look at the limitations of program analysis and decompilation tools, and discuss the challenges in teaching Rust reverse engineering to malware analysts.

Get your ticket for RustConf today: https://rustconf.com/register?utm_source=speaker_referral&utm_medium=referral

#RustConf #RustConf26 #Rust #RustLang #Infosec #Malware #MalwareAnalysis #Reversing #ReverseEngineering

Hello! Just a note that our training at @NorthSec@infosec.exchange this year, Deconstructing Rust Binaries from May 11-13, has been cancelled. @cxiao@infosec.exchange will still be attending NorthSec, so come say hi if you're there! Otherwise, we hope to see you soon at a future training event!

We just wrapped up Deconstructing Rust Binaries, our Rust reverse engineering course, at Ringzer0 last week! It was a real pleasure teaching an engaged class.

Missed out? We're running Deconstructing Rust Binaries again at @NorthSec@infosec.exchange in Montreal, May 11-13, in a hybrid format: https://nsec.io/training/2026-deconstructing-rust-binaries/

3 full days of the first comprehensive course on reversing Rust binaries, using real Rust malware as practice. Save your spot now!

#rustlang #ReverseEngineering #MalwareAnalysis #malware #infosec

Looking for Rust malware samples to practice your reverse engineering skills on? Just since January this year, we've added samples from 8 different malware families to the Rust Malware Sample Gallery: https://github.com/decoderloop/rust-malware-gallery/

1) KCVY OSLOCK Ransomware
2) An unnamed Rust DDoS botnet
3) FunkSec Ransomware
4) RustyWater
5) An unnamed Rust-based loader, mimicking a GoToMeeting DLL
6) Marabu Ransomware
7) An unnamed Rust-based keylogger used by SloppyLemming
8) The VENON banker RAT

Want to learn more about how to reverse these? It's the last chance to sign up for our "Deconstructing Rust Binaries" training, at @ringzer0@infosec.exchange next week: https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/

Can't make it to Ringzer0? We're also offering the "Deconstructing Rust Binaries" training at @NorthSec@infosec.exchange, in May! https://nsec.io/training/2026-deconstructing-rust-binaries/

#rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing

Last day before prices go up for Deconstructing Rust Binaries at @ringzer0@infosec.exchange, March 23-26! If you've been thinking about this fully remote, 16-hour Rust reverse engineering training: now is the time to book!

https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/

#infosec #ReverseEngineering #rustlang #MalwareAnalysis #malware #reversing

Just a few weeks left until our training, Deconstructing Rust Binaries, at Ringzer0 COUNTERMEASURE Spring 2026!

For any reverse engineer who wants to learn practical Rust reversing tips and real Rust malware analysis techniques: this is the course you've been looking for.

4 hours each day across 4 days of fully remote training, March 23-26. Prices go up March 8, so reserve your spot now!

https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/

#MalwareAnalysis #Rust #RustLang #ReverseEngineering #Reversing #Infosec

RE: @NorthSec@infosec.exchange

Very excited to be offering training at NorthSec this year!

📆 Are you looking to spend your training budget for 2026?
🦀 Are you struggling with reversing Rust binaries, and not even sure where to get started?
🇨🇦 Are you looking for high-quality technical training located in Canada?

Consider our 3-day training, "Deconstructing Rust Binaries", at @NorthSec@infosec.exchange from May 11-13 in Montréal: https://nsec.io/training/2026-deconstructing-rust-binaries/

This is the first comprehensive training course focused solely on reverse engineering Rust binaries. You will learn how to effectively triage Rust binaries, how to trace data flow through Rust binaries, and how to tackle common techniques found in the Rust malware ecosystem. Real Rust malware samples are used in the course, ensuring that you have the practical skills to tackle your next Rust sample.

Early bird pricing is available now until Feb. 28th! https://registrations.nsec.io/northsec/2026/

#rust #rustlang #ReverseEngineering #reversing #infosec #MalwareAnalysis #malware #InfosecTraining

FunkSec Ransomware (aka FunkLocker) has been added to the Rust Malware Sample Gallery: https://github.com/decoderloop/rust-malware-gallery#funksec-ransomware #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #ransomware #FunkSec #FunkLocker

A new Rust DDoS Botnet family has been added to the Rust Malware Sample Gallery: https://github.com/decoderloop/rust-malware-gallery#unnamed-rust-ddos-botnet This malware family is currently unnamed, but was analyzed in this 2025-11-30 article by Beelzebub: https://beelzebub.ai/blog/rust-ddos-botnet-honeypot-c2-decoding/ (h/t to @cydave@infosec.exchange ; I learned about the Beelzebub article from his link to it, in his article about setting up a honeypot: https://0dave.ch/posts/flying-whales-in-a-pot-of-honey/) #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #botnet

The Rust ransomware KCVY OSLOCK has been added to the Rust Malware Sample Gallery: https://github.com/decoderloop/rust-malware-gallery#kcvy-oslock #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #ransomware

📣🦀 We're very excited to announce TWO sessions for our flagship Rust reverse engineering course, Deconstructing Rust Binaries, coming to you in early 2026!

1) Deconstructing Rust Binaries at @ringzer0@infosec.exchange COUNTERMEASURE, March 23-26 2026, 16 hours, Remote: https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/

2) Deconstructing Rust Binaries at @NorthSec@infosec.exchange, May 11-13 2026, 24 hours, Onsite in Montréal, Canada and Remote: https://nsec.io/training/2026-deconstructing-rust-binaries/

Deconstructing Rust Binaries is the first comprehensive training course focused _solely_ on reverse engineering Rust binaries. This course is for any reverse engineer who needs a rapid, practical upskill in your ability to analyze Rust binaries. You will learn how to effectively triage Rust binaries, how to trace data flow through Rust binaries, and how to tackle common techniques found in the Rust malware ecosystem.

This course is taught and written by an experienced malware reverse engineer, @cxiao@infosec.exchange, with extensive experience specifically in reversing Rust binaries. Want a preview of the technical expertise we offer? Check out the 120+ FREE slides on Rust reversing from our recent workshop, "Reversing a (Not-so-Simple) Rust Loader"! https://github.com/decoderloop/2025-11-07-ringzer0-countermeasure-not-so-simple-rust-loader-workshop/

A few key things about the course:

1) No previous experience with reversing Rust binaries, or writing Rust code, is required!
2) The course will use Binary Ninja as the primary reverse engineering tool. You will be provided a Binary Ninja student license as part of the course.
3) We're excited to offer flexibility in the training format and course depth. You have the choice of either taking:

a) A fully remote, 4 hour per day, shorter class at Ringzer0 (https://ringzer0.training/countermeasure-spring-2026-deconstructing-rust-binaries/)
b) A remote or onsite, 8 hour per day, comprehensive class at NorthSec (https://nsec.io/training/2026-deconstructing-rust-binaries/)

We look forward to seeing you in 2026!

#infosec #InfosecTraining #malware #MalwareAnalysis #ReverseEngineering #reversing #rust #rustlang #binaryninja #NorthSec #ringzer0 #Ringzer0Training

🦀 Looking for Rust malware samples to practice analyzing? Our Rust Malware Sample Gallery just received a major update, with 20 new families added! https://github.com/decoderloop/rust-malware-gallery

The Sample Gallery collects links to articles about malware written in Rust, organizes them by malware family, and includes a download link to a publicly available sample for every malware family. This is a resource for any malware analyst who wants to get hands-on with real Rust malware.

The last time the Sample Gallery was updated was almost 2 years ago, in January 2024. Since then, there's been an explosive growth in new Rust malware, including all of the following families that are now in the Sample Gallery:

SPICA, KrustyLoader, RustDoor, SSLoad, Fickle Stealer, Cicada3301 Ransomware, RustyClaw, Embargo Ransomware, RustyAttr, Akira Ransomware (both the Akira_v2 and Megazord variants), Banshee (Rust variant), RALord Ransomware, RustoBot, Tetra Loader, EDDIESTEALER, Myth Stealer, Rustonotto, RustyPages, ChaosBot

This is nearly one new Rust malware family observed in the wild, every month. Rust as a programming language for malware is here to stay!

#rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing

The slides and materials from @cxiao@infosec.exchange's "Reversing a (not-so-) Simple Rust Loader" workshop at Ringzer0 COUNTERMEASURE (@ringzer0@infosec.exchange) today are now available! https://github.com/decoderloop/2025-11-07-ringzer0-countermeasure-not-so-simple-rust-loader-workshop In addition to the slides, the materials include an annotated @binaryninja@infosec.exchange database file! Check out the Tags in the database for key locations in the binary, and the History in the database for a step-by-step walkthrough of how we marked up the binary. #rustlang #ReverseEngineering #MalwareAnalysis #infosec #reversing #malware #binaryninja #COUNTERMEASURE25 #ringzer0

Thank you all for your interest in Decoder Loop and Rust reverse engineering training so far!

Our first event is coming up this Friday, November 7th, where @cxiao@infosec.exchange will be presenting the workshop "Reversing a (not-so-) Simple Rust Loader" at the Ringzer0 COUNTERMEASURE conference (@ringzer0@infosec.exchange), in Ottawa, Canada: https://ringzer0.training/countermeasure25-workshop-reversing-a-not-so-simple-rust-loader/

By the end of this workshop, you should know where to get more information about Rust structures and types, know a few tricks for finding interesting landmarks in Rust binaries, and be much more confident in approaching Rust binaries! The workshop will be conducted with @binaryninja@infosec.exchange , so this is also a great chance to get familiar with Binary Ninja.

We hope to see you there! For more information about upcoming workshops and trainings, keep an eye on this account or sign up on our mailing list: https://decoderloop.com/contact/#training-signup-form

#rustlang #ReverseEngineering #MalwareAnalysis #infosec #reversing #malware #binaryninja #COUNTERMEASURE25 #ringzer0