By open-sourcing RIFT, Microsoft aims to strengthen global cybersecurity defenses against the rising threat of Rust-based malware, providing the security community with essential tools to combat increasingly sophisticated cyber threats. The RIFT Static Analyzer serves as an IDA Pro plugin that extracts critical metadata including the Rust compiler commit hash, embedded dependencies, target architecture, and operating system information from binary files. Unlike traditional programming languages, Rust binaries are typically statically linked, incorporating extensive library code that can bloat executables to over 3MB while containing nearly 10,000 functions, compared to C++ programs with fewer than 100 functions and sizes under 20KB. The tool successfully distinguishes between attacker-written code and standard library functions, allowing analysts to focus on malicious logic rather than spending time identifying benign library code. Rust binaries have 10,000+ functions, making traditional malware analysis difficult. The RIFT Diff Applier provides analysts with an interactive interface for applying binary diffing results, operating in both interactive and auto-rename modes with configurable similarity thresholds. RIFT - Microsoft's open-source tool to analyze Rust-based malware like BlackCat and Hive ransomware.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 30 Jun 2025 15:30:15 +0000