BatCloak: the new malware invisible to antiviruses

Since September 2022, a new malware named BatCloak has attracted the attention of cybercriminals for its advanced obfuscation features, making it virtually undetectable by traditional antivirus solutions. BatCloak is distinguished by its ability to transform malicious code into "evasive" versions, making them virtually invisible to major security software. Cybersecurity analyst Pierluigi Paganini, CEO of Cybhorus, explains how malware obfuscation engines like BatCloak have become key components in malware development.

A widespread and multifaceted threat

According to Trend Micro experts, BatCloak allows cybercriminals to upload different families of malware and exploits through obfuscated batch files, greatly facilitating the distribution of threats. Paganini points out that in the underworld of digital crime, obfuscation engines like BatCloak are becoming essential tools for successful malware campaigns.

The problem of detection and the evolution of computer crime

Incredibly, 79.6% of the 784 samples analyzed go undetected by traditional security solutions, underlining BatCloak's effectiveness in bypassing detection mechanisms. Paganini highlights the growth of the market that develops around these software, highlighting the importance of responding to this threat. Furthermore, the expert predicts that the increased demand for these tools will lead to the development of new obfuscation engines, enhancing the evasion capacity of existing malware.

Mitigating risk: defense strategies

In the context of this growing threat, the need for constant security program updates becomes critical. It is essential to integrate the new indicators of compromise released by researchers and stay abreast of increasingly sophisticated attack techniques. For example, ScrubCrypt, a malware born from the transition from an open-source framework to a closed-source model, is designed to work with well-known malware families such as Amadey, AsyncRAT, DarkCrystal RAT, Pure Miner, Quasar RAT, RedLine Stealer, Remcos RAT , SmokeLoader, VenomRAT and Warzone RAT. The search also detects IP addresses, URLs used to spread payloads, hashes of compromised files, and commonly used file names, providing valuable tools for mitigating risk.