Which Programming Languages Fuel Today’s Malware Attacks

It is difficult to claim that any system or program is completely secure. All of them may contain potential vulnerabilities - errors made during the development process - that can lead to serious consequences. Attackers often exploit such flaws. Information security companies continuously monitor vulnerabilities and update security databases. Their monitoring typically includes sources such as the U.S. Government’s National Vulnerability Database (NVD), security advisories, GitHub issue trackers, and open-source projects. To create malicious code, attackers use a variety of programming languages. Some are more popular in cybercriminal circles due to their ease of use, compatibility with specific systems, and the wide availability of libraries that help solve particular problems. The Most Common Programming Languages Used in Cyberattacks It is important to understand that a programming language is merely a tool. Far more critical are the skills and experience of the malware developer - their expertise in the operating systems targeted, their knowledge of cryptography, and their understanding of how network protocols function. For example, if an attacker is proficient at evading detection on an endpoint and effectively implements communication between the malware and command-and-control servers, the choice of programming language becomes secondary. The language used is typically determined by the environment in which the malicious code will run and the specific tasks it needs to perform. Nevertheless, numerous studies and observations indicate that the majority of sophisticated malicious programs with extensive functionality are primarily developed in C and C++. These languages are favored for creating serious threats because they provide low-level access to system resources, allow direct memory manipulation, and enable the construction of complex structures that hinder analysis and detection. Another factor contributing to their popularity in the cybercriminal ecosystem is their portability - C and C++ have minimal runtime dependencies, making it easier to compile and adapt malicious code across different platforms. Cybersecurity experts also point out that C, in particular, is prone to undefined behavior, which often results in security flaws and exploitable vulnerabilities in software infrastructure. Beyond C The criminal IT underground also effectively leverages other programming and scripting languages. In Windows environments, attackers frequently rely on PowerShell, a command-line shell and scripting language developed by Microsoft, based on the .NET Framework and .NET Core. PowerShell is installed by default on all modern Windows systems and is highly valued by threat actors for its powerful system management capabilities. While PowerShell is widely used by IT professionals to automate tasks, manage system configurations, and enable interoperability between services, cybercriminals exploit these same features to move laterally across networks, gather intelligence, maintain persistence, evade detection, and modify system settings to facilitate subsequent stages of an attack. In *Unix-like (nix) systems, the go-to scripting language for similar purposes is Bash (Bourne Again Shell) - the default command-line interface in most Linux distributions. Bash scripts allow for extensive control over system processes, configurations, user interactions, and data management. These capabilities make Bash particularly appealing to attackers looking to automate malicious tasks, manipulate system behavior, and establish control over compromised systems in Linux-based environments. Malware developers have also turned their attention to web technologies, which power the websites and services users access every day. In this domain, JavaScript stands out as one of the most exploited languages by cybercriminals. It is commonly used to craft malicious scripts for cross-site scripting (XSS) attacks, where harmful JavaScript code is injected into web pages viewed by unsuspecting users. Attackers also use JavaScript to build payload loaders and string obfuscators, which conceal malicious content and help execute it on the victim’s machine. These techniques enable the silent delivery and execution of malware through seemingly legitimate web interactions. Python’s Role in Modern Malware Creation The range of programming languages that can be used for malicious purposes is broad -malware can be written in virtually any language, depending on the attacker’s objectives and the target environment. While some languages are more common in the development of cyber threats, others see limited use. For example, Python, despite its popularity among legitimate developers and cybersecurity professionals, is less frequently used by malware creators. This is primarily due to its interpreted nature, larger runtime dependencies, and the ease with which Python-based code can be analyzed and detected compared to compiled languages l

May 11, 2025 - 11:42

Which Programming Languages Fuel Today’s Malware Attacks

It is difficult to claim that any system or program is completely secure. All of them may contain potential vulnerabilities - errors made during the development process - that can lead to serious consequences. Attackers often exploit such flaws. Information security companies continuously monitor vulnerabilities and update security databases. Their monitoring typically includes sources such as the U.S. Government’s National Vulnerability Database (NVD), security advisories, GitHub issue trackers, and open-source projects.

To create malicious code, attackers use a variety of programming languages. Some are more popular in cybercriminal circles due to their ease of use, compatibility with specific systems, and the wide availability of libraries that help solve particular problems.

The Most Common Programming Languages Used in Cyberattacks

It is important to understand that a programming language is merely a tool. Far more critical are the skills and experience of the malware developer - their expertise in the operating systems targeted, their knowledge of cryptography, and their understanding of how network protocols function.

For example, if an attacker is proficient at evading detection on an endpoint and effectively implements communication between the malware and command-and-control servers, the choice of programming language becomes secondary. The language used is typically determined by the environment in which the malicious code will run and the specific tasks it needs to perform.

Nevertheless, numerous studies and observations indicate that the majority of sophisticated malicious programs with extensive functionality are primarily developed in C and C++. These languages are favored for creating serious threats because they provide low-level access to system resources, allow direct memory manipulation, and enable the construction of complex structures that hinder analysis and detection.

Another factor contributing to their popularity in the cybercriminal ecosystem is their portability - C and C++ have minimal runtime dependencies, making it easier to compile and adapt malicious code across different platforms. Cybersecurity experts also point out that C, in particular, is prone to undefined behavior, which often results in security flaws and exploitable vulnerabilities in software infrastructure.

Beyond C

The criminal IT underground also effectively leverages other programming and scripting languages. In Windows environments, attackers frequently rely on PowerShell, a command-line shell and scripting language developed by Microsoft, based on the .NET Framework and .NET Core. PowerShell is installed by default on all modern Windows systems and is highly valued by threat actors for its powerful system management capabilities. While PowerShell is widely used by IT professionals to automate tasks, manage system configurations, and enable interoperability between services, cybercriminals exploit these same features to move laterally across networks, gather intelligence, maintain persistence, evade detection, and modify system settings to facilitate subsequent stages of an attack.

In *Unix-like (nix) systems, the go-to scripting language for similar purposes is Bash (Bourne Again Shell) - the default command-line interface in most Linux distributions. Bash scripts allow for extensive control over system processes, configurations, user interactions, and data management. These capabilities make Bash particularly appealing to attackers looking to automate malicious tasks, manipulate system behavior, and establish control over compromised systems in Linux-based environments.

Malware developers have also turned their attention to web technologies, which power the websites and services users access every day. In this domain, JavaScript stands out as one of the most exploited languages by cybercriminals. It is commonly used to craft malicious scripts for cross-site scripting (XSS) attacks, where harmful JavaScript code is injected into web pages viewed by unsuspecting users. Attackers also use JavaScript to build payload loaders and string obfuscators, which conceal malicious content and help execute it on the victim’s machine. These techniques enable the silent delivery and execution of malware through seemingly legitimate web interactions.

Python’s Role in Modern Malware Creation

The range of programming languages that can be used for malicious purposes is broad -malware can be written in virtually any language, depending on the attacker’s objectives and the target environment. While some languages are more common in the development of cyber threats, others see limited use. For example, Python, despite its popularity among legitimate developers and cybersecurity professionals, is less frequently used by malware creators. This is primarily due to its interpreted nature, larger runtime dependencies, and the ease with which Python-based code can be analyzed and detected compared to compiled languages like C or C++.

Although Python is less commonly used for creating sophisticated malware, it is still employed in the development of various types of malicious software, particularly for prototyping, automation, or targeting systems where Python is already installed. The most common types of Python-based malware include:

Stealers – Programs designed to collect sensitive user and system data from a victim’s device and transmit it to an attacker-controlled server. A notable example is the Snake malware, which demonstrated how effective Python can be for data exfiltration.
Downloaders – Lightweight scripts used to retrieve additional malware, libraries, or payloads from remote servers, acting as an initial stage in multi-phase attacks.
Miners – Malicious programs that exploit a victim’s computing resources to mine cryptocurrencies such as Monero, often running quietly in the background to avoid detection.
Encryptors (Ransomware) – Tools that perform unauthorized cryptographic operations on a victim’s files, effectively locking them and demanding payment for decryption. Python-based versions are often seen in proof-of-concept ransomware or low-sophistication campaigns.

Protecting Against Python-Based Malware

There are no unique protection methods tailored specifically to malware written in Python. Instead, the most effective defense lies in adhering to general digital hygiene practices and established information security policies. These best practices form the foundation of device and network protection, regardless of the programming language used to create malicious code. Cybersecurity professionals are well aware of these measures and typically implement them as part of standard security protocols. Let’s revisit the core principles that underpin adequate protection.

Comprehensive antivirus coverage across all endpoints – Ensuring that every device within the network is protected by reputable and regularly updated antivirus software like Fortect Antivirus or endpoint detection and response (EDR) solutions.
Layered security measures and infrastructure hardening – Using information security tools in combination with proper system configuration, regular software updates, centralized event monitoring, and secure architecture design to minimize vulnerabilities.
Ongoing employee training and awareness – Continuously educating staff on cybersecurity threats and safe digital behavior, with a strong focus on identifying phishing attempts, malicious attachments, and suspicious links, especially in corporate email.
Regular backups of critical data – Implementing automated and secure backup procedures to ensure data recovery in the event of ransomware attacks or other forms of data loss.

Conclusion

Software security issues are well-known and have been extensively documented. Developers learning to write applications are typically taught the principles of clean code and secure development practices from the outset. A brief search online reveals countless resources offering detailed and accessible recommendations for building secure software. However, even when best practices are followed during development, mistakes can still occur, resulting in vulnerabilities that attackers may exploit. To mitigate such risks, security technologies are often embedded at the operating system (OS) level, providing additional layers of defense against exploitation through software flaws.