Loading story…
Palo Alto Networks Unit 42 reported that malware written in Go had grown steadily in the wild, based on analysis of roughly 10,700 unique samples collected from VirusTotal and internal repositories. After filtering out about 2,000 false positives through YARA matching and manual clustering, researchers found that 75% of the remaining samples could be assigned to known malware families, identifying 53 distinct families overall.
The study found that 92% of identified Go malware targeted Windows, with Linux and macOS representing much smaller portions of the dataset. The most prevalent families included Veil, GoBot2, and HERCULES, while the most common category was penetration-testing-related tooling, followed by RATs, backdoors, coinminers, and information stealers, indicating that Go was becoming an increasingly attractive language for cross-platform malicious tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The research observed a significant increase in identified Go-based malware samples during the January-to-March period across 2017 through 2019, with counts rising by nearly 20 times overall. This trend was cited as evidence that Go malware was steadily gaining popularity.
Palo Alto Networks Unit 42 published research analyzing roughly 10,700 unique Go-based malware samples after filtering and validation. The study identified 53 malware families, found Windows was the dominant target platform, and reported that Go malware remained limited but was steadily increasing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026
Researchers reported multiple intrusion campaigns adopting **Golang-based malware loaders** delivered through phishing to improve evasion and persistence. In one campaign, tracked as **GO#WEBBFUSCATOR**, attackers sent malicious Microsoft Office documents that abused an external template to retrieve a `DOTM` file, whose VBA macros downloaded a JPEG with appended Base64 data, decoded it with `certutil`, and launched a Golang executable named `msdllupdate.exe`. The malware used layered obfuscation including **ROT25**, **XOR-obfuscated Go assemblies**, and gobfuscation, then persisted by copying itself into `LOCALAPPDATA` and creating a **Run** key under `HKCU`. A separate campaign tied to **TA416**/**Mustang Panda** used phishing lures themed around Vatican-China relations and spoofed journalist identities to target Catholic, diplomatic, Myanmar, and African organizations. Proofpoint said the actor deployed a **Golang-based PlugX loader** inside RAR archives, using a legitimate Adobe executable for **DLL side-loading** of `hex.dll`, which decrypted `adobeupdate.dat` and executed the PlugX payload. Across the campaigns, operators relied on stealthy command-and-control methods, including **TXT DNS requests via `nslookup`** to attacker-controlled domains such as `xmlschemeformat.com`, `apiregis.com`, and `updatesagent.com`, while TA416 infrastructure included command-and-control IP `45.248.87[.]162`, underscoring a broader shift toward Golang tooling in espionage-focused malware operations.
Aug 15, 2026
Researchers linked **222 GitHub repositories** across **190 accounts** to a malware distribution campaign dubbed **Operation Muck and Load**, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, `ischhfd83@rambler[.]ru`, and identified a malicious module, `github[.]com/kaleidora/dnsub-scanning-tool`, as a first-stage Windows loader. Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including **Vidar infostealer**, **AsyncRAT**, **Quasar RAT**, **Remcos-style RATs**, spyware, and **Monero cryptominers** tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.
Jul 11, 2026