Loading story…
Researchers documented multiple malware families implemented in Go, including a newly analyzed information stealer and a Sofacy-linked Zebrocy variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis.
Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious .lnk file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a Run registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On December 5, 2018, Bitly statistics observed for the Dear Joohn campaign link showed it had been created on December 3 and had received 75 visits, mostly from Turkey. This provided evidence that the delivery infrastructure was active and attracting targets.
A second delivery chain tied to the "Dear Joohn" campaign used a Word document and shortened Bitly link that were both created on December 3, 2018. The document fetched a remote template containing a macro that ultimately dropped and ran a Go Zebrocy downloader.
On October 11, 2018, Sofacy used a spear-phishing email with an LNK file masquerading as a Word document to deliver a new Go-based Zebrocy variant. The chain was intended to drop a decoy document and a Go Zebrocy executable, but execution failed because the embedded PowerShell referenced the wrong LNK filename.
Unit 42 reported that Sofacy had introduced a new Zebrocy variant written in Go and documented two observed delivery chains using it. The analysis linked the malware to prior Zebrocy activity through shared infrastructure and overlapping beacon characteristics.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Sofacy-linked **Zebrocy** campaign targeted government, diplomatic, and related organizations across Central Asia, Europe, the Middle East, and Asia with spearphishing emails carrying layered malware attachments. Reported targets included entities in **Kazakhstan, Kyrgyzstan, Azerbaijan, and Tajikistan**, with lures using shortcut files, archives, decoy documents, PowerShell scripts, and base64-encoded payloads to begin the infection chain. The operation introduced a new downloader written in **Go** that gathered detailed system information, sent it to a hardcoded command-and-control server, then retrieved additional **Zebrocy AutoIT/Delphi** payloads, established persistence, and deleted itself. Researchers said the activity showed both rising campaign volume and continued malware development within the Zebrocy cluster, even as more traditional Sofacy **SPLM/XAgent** activity appeared to be declining.
Aug 14, 2026
Researchers reported multiple intrusion campaigns adopting **Golang-based malware loaders** delivered through phishing to improve evasion and persistence. In one campaign, tracked as **GO#WEBBFUSCATOR**, attackers sent malicious Microsoft Office documents that abused an external template to retrieve a `DOTM` file, whose VBA macros downloaded a JPEG with appended Base64 data, decoded it with `certutil`, and launched a Golang executable named `msdllupdate.exe`. The malware used layered obfuscation including **ROT25**, **XOR-obfuscated Go assemblies**, and gobfuscation, then persisted by copying itself into `LOCALAPPDATA` and creating a **Run** key under `HKCU`. A separate campaign tied to **TA416**/**Mustang Panda** used phishing lures themed around Vatican-China relations and spoofed journalist identities to target Catholic, diplomatic, Myanmar, and African organizations. Proofpoint said the actor deployed a **Golang-based PlugX loader** inside RAR archives, using a legitimate Adobe executable for **DLL side-loading** of `hex.dll`, which decrypted `adobeupdate.dat` and executed the PlugX payload. Across the campaigns, operators relied on stealthy command-and-control methods, including **TXT DNS requests via `nslookup`** to attacker-controlled domains such as `xmlschemeformat.com`, `apiregis.com`, and `updatesagent.com`, while TA416 infrastructure included command-and-control IP `45.248.87[.]162`, underscoring a broader shift toward Golang tooling in espionage-focused malware operations.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that malware written in **Go** had grown steadily in the wild, based on analysis of roughly **10,700 unique samples** collected from VirusTotal and internal repositories. After filtering out about **2,000 false positives** through YARA matching and manual clustering, researchers found that **75%** of the remaining samples could be assigned to known malware families, identifying **53 distinct families** overall. The study found that **92%** of identified Go malware targeted **Windows**, with Linux and macOS representing much smaller portions of the dataset. The most prevalent families included **Veil**, **GoBot2**, and **HERCULES**, while the most common category was **penetration-testing-related tooling**, followed by **RATs**, **backdoors**, **coinminers**, and **information stealers**, indicating that Go was becoming an increasingly attractive language for cross-platform malicious tooling.
Aug 15, 2026