QUICAgent: Go-Based Backdoor
QUICAgent is a Golang-based backdoor used in Operation QUICSILVER. It employs sandbox evasion, communicates via QUIC over UDP port 443, and supports…
Tag: Go
CornFlake RAT: Go-Based Remote Access Trojan Used in CaptiveCrunch
CornFlake RAT is a Go-based remote access trojan deployed via adversary-in-the-middle (AitM) attacks, often disguised as browser or OS updates. It performs…
GoginRAT: Go-Based RAT with AI-Assisted Development
GoginRAT is a Go-based remote access tool with architectural similarities to NomadRAT. It uses a separate transmitter for C2 and implements file…
wincfg: Go-Based Stealer Payload
wincfg is a Go-based stealer payload used in the StubMaker campaign. It extracts credentials from Chromium-based browsers, collects cryptocurrency wallets and seed…
CornFlake RAT
Go-based remote access trojan delivered via fake updates in the CaptiveCrunch campaign. It captures screenshots, steals credentials, and provides remote shell access.
ENCFORGE: New Go-Based Ransomware Targeting AI Infrastructure
A compiled Go ransomware designed to encrypt AI model files, vector indexes, and training datasets. Uses AES-256-CTR with RSA-2048 key wrapping. Targets…
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator first documented earlier this…
Caeruleus: Open-Source Bluetooth Low Energy Testing Toolkit
Caeruleus is a free open-source toolkit from Praetorian that consolidates Bluetooth Low Energy testing into a single Go binary. It supports scanning,…
FlockWiper: Multi-Pass Wiper
FlockWiper is a multi-pass wiper that overwrites the Windows drive with different data patterns. It was rewritten in Go for GigaWiper and…
Lambsys: Custom Monero Miner Malware
Lambsys is a Go-based ELF executable used in cryptojacking campaigns targeting Langflow vulnerabilities. It terminates rival miners, disables security controls, establishes persistence,…