The Gopher in the Room: Analysis of GoLang Malware in the Wild
Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.
Unit 42 collected roughly 10,700 unique Go-compiled malware samples and found that Go usage by malware developers has steadily risen in recent months. About 92% of samples targeted Windows and 75% were attributed to known families, led by Veil, GoBot2, and HERCULES. The most prevalent groupings were penetration testing tools, remote access Trojans, and backdoors. Statically linked Go binaries average 4.65MB, which can complicate phishing delivery but sometimes causes antivirus products to skip or fail scanning.
45