Avast Threat Labs provides an overview of recently observed Golang based malware. It covers Backdoorit, a multiplatform RAT mostly after Minecraft files and Visual Studio and IntelliJ projects, and Caligula, an IRC-controlled DDoS botnet built on the open source Hellabot project. Both were undetected on VirusTotal when Avast found them in late April. Multiplatform support and the relative ease of development make Golang attractive for malicious purposes as well. An ever increasing number of open source tools on GitHub, sometimes reused by different threat actors, helps too. The trend is not new: CrowdStrike reported an 80% increase in Go-written malware samples from June to August 2021, with coin miners making up 70% of them by August.
