The Gopher in the Room: Analysis of GoLang Malware in the Wild
Summary: Unit 42 researcher Josh Grunzweig collected roughly 10,700 unique Go-compiled malware samples from Palo Alto Networks' own repositories and VirusTotal, finding that Go malware has been steadily rising based on first-seen timestamps. Of the samples, 92% were compiled for Windows, 4.5% for Linux, and the rest for OSX, with 53 malware families identified and Veil, GoBot2, and HERCULES the most prominent.
Bottom line: The most prevalent Go samples fell into pentesting, RAT, and backdoor categories, and the average sample size of 4.65MB can cause some antivirus products to skip or fail to scan the file entirely - the same oversized-file gap Comnie's authors exploited by appending 64MB of garbage.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026