Threats Tagged 'go-based'

Prinz Eugen is a newly discovered Go-based ransomware family first observed in April 2026, attributed to an actor known as ROOTBOY. The encryptor employs sophisticated techniques including ChaCha20-Poly1305 encryption, prioritizes recently modified files to maximize pressure on victims, and implements anti-forensic measures such as memory scrubbing and self-deletion. Unlike typical ransomware, it leaves no ransom note on disk, conducting all extortion communications out-of-band through leak sites and direct contact. The threat actor gains initial access through compromised RDP credentials, uses legitimate RMM tools like RemotePC for persistence, and creates backdoor admin accounts. Victims span multiple countries and sectors, with notable incidents including Standard Bank Group in South Africa and Transitions Pro Centre Val de Loire in France.

MediumMalwareSouth AfricaFranceUnited States+1#prinz eugen#rootboy#go-based

A new Go-based remote access trojan named Moonrise has been discovered, operating without early static detection and establishing active C2 communication before vendor alerts. The RAT supports credential theft, remote command execution, persistence, and user monitoring, enabling full remote control of infected endpoints. Its capabilities include stealing passwords, executing remote commands, uploading files, capturing screens, and accessing webcams and microphones. The malware's silent operation increases business exposure, extending dwell time and raising risks of data loss and operational disruption. The attack chain involves session registration, host environment visibility, direct system interaction, credential access, active user monitoring, and privilege manipulation. Early detection strategies involve monitoring for weak signals, rapid triage with behavior confirmation, and threat hunting to prevent repeat incidents.

MediumCampaignUnited StatesUnited KingdomGermany+9#credential theft#remote access trojan#moonrise rat

Yurei ransomware, identified in September 2025, targets corporate networks primarily in transportation, IT, marketing, and food sectors. Developed in Go, it uses strong encryption algorithms ChaCha20-Poly1305 for file encryption and secp256k1-ECIES for key protection. The ransomware excludes certain files and directories to maintain system operability. Each file is encrypted with a unique key and nonce, ensuring only the attacker can decrypt the data. The ransom note threatens data leaks and regulatory notifications if demands are unmet within five days. While currently observed in Sri Lanka and Nigeria, the ransomware’s sophisticated encryption and typical corporate targeting pose a medium-level threat globally. No known exploits in the wild or CVEs exist yet. European organizations should be vigilant due to potential expansion and regulatory impact. Mitigation requires proactive network segmentation, strict access controls, and advanced detection of lateral movement and privilege escalation.

MediumMalwareGermanyFranceNetherlands+4#darkweb#chacha20-poly1305#secp256k1-ecies

ZynorRAT is a newly discovered Go-based Remote Access Trojan that provides a full suite of command and control capabilities for Linux and Windows systems. It was first identified in July 2025 and is believed to be of Turkish origin. The malware uses Telegram as its C2 infrastructure and offers features such as file exfiltration, system enumeration, screenshot capture, persistence through systemd services, and arbitrary command execution. The Linux version is fully functional, while the Windows version appears to be in early development. The malware's author seems to be actively working on improving its detection avoidance. ZynorRAT's capabilities include discovery, exfiltration, persistence, and remote code execution on victim machines.

MediumMalwareTurkeyGermanyFrance+5#remote access trojan#zynorrat#go-based

Salat Stealer, a sophisticated Go-based infostealer targeting Windows systems, has been identified. It exfiltrates browser credentials, cryptocurrency wallet data, and session information while employing advanced evasion techniques. The malware uses UPX packing, process masquerading, registry run keys, and scheduled tasks for persistence and evasion. Operated under a Malware-as-a-Service model by Russian-speaking actors, it leverages resilient C2 infrastructure. The stealer targets multiple browsers, cryptocurrency wallets, and Telegram sessions. It communicates with its C2 server using UDP and HTTPS, with multiple fallback domains for redundancy. The control panel supports real-time interaction through WebSockets and includes features for remote command execution and system manipulation.

MediumMalwareGermanyFranceNetherlands+4#persistence#salat stealer#malware-as-a-service