Loading story…
Researchers and malware analysts documented how Garble obfuscation is complicating reverse engineering of Go-based malware, particularly around stripped function names and runtime string reconstruction. Walmart Global Tech described a proof-of-concept for recovering Go standard library functions by matching bytecode sequences instead of relying on .gopclntab, while Mandiant detailed how Garble's string transformations split and encrypt data into randomized state-machine logic that is rebuilt and decrypted at runtime. OpenAnalysis separately highlighted a Garble-protected Windows stealer sample whose recovered artifacts pointed to credential theft, wallet targeting, anti-analysis checks, and exfiltration activity.
A recent analysis of Amatera Stealer showed the operational impact of those techniques in the wild: a 32-bit Delphi loader retrieved and launched a heavily obfuscated Go third-stage payload, initially misleading analysis because Garble protection made strings and logic difficult to interpret. The analyst later determined the sample likely used Garble without literal encryption, with strings still present but constructed dynamically at runtime; recovered behavior included persistence via a scheduled task for shark.exe, plus network indicators tied to the malware's infrastructure and a DNS lookup for data-seed-prebsc-2-s1.binance.org resolving to 109.172.87.40.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Runtime inspection of the Amatera sample revealed persistence via a scheduled task adding shark.exe, one malicious IP address in memory, and a DNS query to data-seed-prebsc-2-s1.binance.org resolving to 109.172.87.40.
The analyst updated the Amatera sample assessment to note that the Go payload appeared to use Garble without the -literals option, correcting an earlier belief that literal encryption was preventing tooling from recovering strings.
A GitHub malware analysis report examined a sample fetched from Amatera C2 infrastructure at h4.possumdefense.digital/shark.bin, identifying a 32-bit Delphi loader that unpacked a heavily obfuscated Go third stage.
A Google Cloud blog post from Mandiant detailed Garble's split string obfuscation transformation, showing how strings are chunked, encrypted, and reconstructed at runtime through a randomized state-machine generated with Go AST constructs.
OpenAnalysis published a raw artifact dump from a Windows infostealer sample that included the string "BANDIT STEALER," numerous credential- and wallet-theft targets, anti-analysis checks, and the endpoint mtls://159.223.189.221:8888.
A Walmart Global Tech blog post described a proof-of-concept method for de-obfuscating Go binaries by matching standard library functions via bytecode sequences, including tests against unobfuscated, name-mangled, and VirusTotal samples.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecloud.google.com
Open sourceresearch.openanalysis.net
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026
Researchers reported multiple intrusion campaigns adopting **Golang-based malware loaders** delivered through phishing to improve evasion and persistence. In one campaign, tracked as **GO#WEBBFUSCATOR**, attackers sent malicious Microsoft Office documents that abused an external template to retrieve a `DOTM` file, whose VBA macros downloaded a JPEG with appended Base64 data, decoded it with `certutil`, and launched a Golang executable named `msdllupdate.exe`. The malware used layered obfuscation including **ROT25**, **XOR-obfuscated Go assemblies**, and gobfuscation, then persisted by copying itself into `LOCALAPPDATA` and creating a **Run** key under `HKCU`. A separate campaign tied to **TA416**/**Mustang Panda** used phishing lures themed around Vatican-China relations and spoofed journalist identities to target Catholic, diplomatic, Myanmar, and African organizations. Proofpoint said the actor deployed a **Golang-based PlugX loader** inside RAR archives, using a legitimate Adobe executable for **DLL side-loading** of `hex.dll`, which decrypted `adobeupdate.dat` and executed the PlugX payload. Across the campaigns, operators relied on stealthy command-and-control methods, including **TXT DNS requests via `nslookup`** to attacker-controlled domains such as `xmlschemeformat.com`, `apiregis.com`, and `updatesagent.com`, while TA416 infrastructure included command-and-control IP `45.248.87[.]162`, underscoring a broader shift toward Golang tooling in espionage-focused malware operations.
Aug 15, 2026
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026