We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

BatCloak Malware Obfuscation Engine Outsmarts Antivirus

BatCloak Malware Obfuscation Engine Outsmarts Antivirus
Zane Kennedy Published on 14th June 2023 Cybersecurity Researcher

Trend Micro researchers have shed light on the emergence of an advanced malware obfuscation engine called BatCloak. This highly sophisticated tool has demonstrated a remarkable ability to outsmart antivirus solutions, posing new challenges for the cybersecurity community.

Running analysis and sample collection from September 2022 to June 2023, the researchers uncovered a series of heavily obfuscated batch files employing the BatCloak engine. These files have proven to be fully undetectable (FUD), allowing threat actors to persistently evade security solutions while deploying various malware families and exploits.

One of the most concerning findings of the investigation is the success rate of BatCloak’s evasion mechanisms. During the analysis of batch samples sourced from a public repository, the researchers found that over 80% of the 784 samples were not being detected by security solutions.

The BatCloak engine lies at the core of a free open-source FUD builder called Jlaive, which allows cybercriminals to deploy multiple malware families easily through highly obfuscated batch files. Jlaive has gained traction since its original release in September 2022, with cybercriminals leveraging its capabilities to bypass the Antimalware Scan Interface (AMSI), compress payloads, and encrypt the primary code to minimize the chance of detection.

While the original Jlaive repository was taken down, modified versions and clones of the tool continue to surface on code hosting platforms such as GitHub and GitLab. Threat actors have even ported the tool to other programming languages, further expanding its availability and usage.

BatCloak's evolving nature is evident in its latest version, ScrubCrypt, which was recently identified by Fortinet FortiGuard Labs during an investigation into a cryptojacking operation orchestrated by the 8220 Gang. ScrubCrypt is designed to be interoperable with various well-known malware families, including DCRAT, Quasar RAT, RedLine Stealer, Remcos RAT, VenomRAT, and Warzone RAT.

“Understanding the evolving landscape of advanced malware techniques such as FUD obfuscator BatCloak enables us to develop more effective strategies for combating the ever-evolving threats posed by these sophisticated adversaries. These findings highlight the pressing need for enhanced approaches to malware detection and prevention, such as a cutting-edge multilayered defensive strategy and comprehensive security solutions,” stated Trend Micro.

The report from Trend Micro was the first of a three-part technical research series. The subsequent installment will explore the updated BatCloak engine embedded within SeroXen, a remote access trojan (RAT).

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.