The Dark Side of Go: A 2020 Go Malware Round Up
summary
A 2020 survey of Go malware shows nation state and criminal groups adopting Go for cross platform payloads and stealthy toolchains, with Russia-linked APT28 using a multi language downloader Zebraspy to spearphish embassies, APT29/CozyBear using WellMess against COVID‑19 vaccine researchers, and Nobelium producing compact tools named GoldMax backdoor and GoldFind tracer after SolarWinds. Criminals ship AES‑encrypted payloads appended to binaries that unpack via memfd_create in-memory exec, clipboard stealers swap addresses netting 11 BTC replacement, IPFS and P2P bots appear, and ransomware like Nephilim targets big game victims.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:28Metadata to the Rescue
- 4:19Go Malware Prior to 2020 2017-2019 increase of 1944%
- 6:58Go in Russia's cyber intelligence
- 10:41It All Started with a Phish
- 14:12Code reuse
- 15:48NOBELIUM a.k.a UNC2452
- 19:01Holy Water/Storm Cloud APT
- 20:04Loaders/Crypters
- 24:06Stealers
- 25:14Clipboard Stealer
- 27:06Ransomware Migrating to Go
- 28:07New Ransomware Written in Go
- 29:11Cross-Platform Mining Bots • Linux and Windows
- 29:40P2P Bots
- 30:19Future Predictions
- 31:29Conclusion
related talks
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
27mA Deep Dive into Go Malware: Using Metadata to Empower the Analyst
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
16mNation-State Threats in the Open-Source Software Supply Chain
47mMissing Piece of Cloud Security
55mGovernments As Malware Authors: The Next Generation
40mDiscord, Generation Z’s Hacking University
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack