SecuriTricks - golang

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

A new threat group dubbed Silent Lynx has been uncovered targeting entities in Kyrgyzstan and neighboring nations. The group, believed to be Kazakhstan-based, employs sophisticated multi-stage attack strategies using ISO files, C++ loaders, PowerShell scripts, and Golang implants. Their campaigns f…

apt

espionage

xerox_scan17510875802718752175.exe

kyrgyzstan

resocks

Published: January 21, 2025

Downloadable IOCs: 12

NotLockBit: A Deep Dive Into the New Ransomware Threat

NotLockBit is an emerging ransomware family that mimics LockBit's behavior while targeting both macOS and Windows systems. Distributed as an x86_64 golang binary, it showcases advanced capabilities including targeted file encryption, data exfiltration, and self-deletion mechanisms. The malware gath…

Published: December 19, 2024

Downloadable IOCs: 5

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Elastic Security Labs has uncovered a new intrusion set targeting Chinese-speaking regions, dubbed REF3864. The threat group employs a custom loader called SADBRIDGE to deploy GOSAR, a Golang-based reimplementation of the QUASAR backdoor. The infection chain involves trojanized MSI installers masqu…

Published: December 16, 2024

Downloadable IOCs: 13

Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

FrostyGoop, an operational technology (OT) malware, disrupted critical infrastructure in Ukraine in early 2024, affecting heating systems for over 600 apartment buildings. It is the first OT-centric malware to use Modbus TCP communications for such an impact. The malware can operate both within com…

ukraine

golang

critical infrastructure

2024-11-19

ot-malware

industrial control systems

bustleberm

modbus tcp

frostygoop

Published: November 19, 2024

Linked vulnerabilities : CVE-2024-0012 (CVSS 9.8), CVE-2023-33538, CVE-2023-50358

Downloadable IOCs: 25

New threat targeting macOS discovered

Jamf Threat Labs uncovered malware samples linked to North Korea, built using Flutter, which provides inherent obfuscation. The malware, discovered in late October, includes Go, Python, and Flutter variants. The Flutter-built application presents a minesweeper game while making network requests to …

Published: November 13, 2024

Downloadable IOCs: 0

Fake LockBit Real Damage Ransomware Samples Abuse AWS S3 to Steal Data

This report discusses malicious Golang ransomware samples that exploit Amazon S3's Transfer Acceleration feature to exfiltrate victims' data and upload it to attacker-controlled S3 buckets. The samples contained hard-coded AWS credentials linked to compromised accounts, allowing the researchers to …

Published: October 17, 2024

Downloadable IOCs: 39

Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

A new multiplatform backdoor named KTLVdoor, written in Golang with versions for Windows and Linux, has been discovered during monitoring of the Chinese-speaking threat actor Earth Lusca. This highly obfuscated malware impersonates system utilities and allows attackers to control infected systems, …

golang

2024-09-04

ktlvdoor

Published: September 4, 2024

Downloadable IOCs: 180

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

This report analyzes Cthulhu Stealer, a malware-as-a-service targeting macOS users to steal credentials and cryptocurrency wallets. It explores the malware's functionality, including prompting users for passwords, dumping keychain data, and exfiltrating stolen information. The analysis compares Cth…

Published: August 23, 2024

Downloadable IOCs: 9

Analysis of Golang Payload and Information Theft Campaign

The report details a recent cyber attack campaign attributed to the APT-C-09 (Mozambique) threat group, which has historically targeted Pakistan and surrounding nations. The campaign employed a novel Golang malware payload and Quasar RAT to gather sensitive information. The analysis covers the tech…

Published: July 30, 2024

Downloadable IOCs: 8

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

A long-running campaign was identified involving malicious actors impersonating Israeli entities and private companies. The operators delivered payloads through crafted WordPress sites, employing a mix of custom code and open-source malware like Donut and Sliver. While the motivations remain unclea…

Published: June 28, 2024

Downloadable IOCs: 18

DISGOMOJI Malware Used to Target Indian Government

Volexity identified a cyber-espionage campaign by a suspected Pakistan-based threat actor tracked as UTA0137 targeting government entities in India. The campaign leveraged the DISGOMOJI malware, a Golang-based Linux trojan that uses Discord for command and control via emojis. Key capabilities inclu…

Published: June 18, 2024

Linked vulnerabilities : CVE-2024-3400, CVE-2022-0847

Downloadable IOCs: 149

Tag: golang

Attack reports

From open-source to open threat: Tracking Chaos RAT’s evolution

Marbled Dust leverages zero-day in Output Messenger for regional espionage

GhostSocks - Partner In Proxy

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

NotLockBit: A Deep Dive Into the New Ransomware Threat

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

New threat targeting macOS discovered

Fake LockBit Real Damage Ransomware Samples Abuse AWS S3 to Steal Data

Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

Analysis of Golang Payload and Information Theft Campaign

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

DISGOMOJI Malware Used to Target Indian Government