Gopher Malware: Analysis, Detection, Removal
Gopher malware is a family of malicious software, often written in the Go (Golang) programming language, designed for various cyberattacks, including data theft, espionage, and ransomware.
Gopher malware is a family of malicious software, often written in the Go (Golang) programming language, designed for various cyberattacks, including data theft, espionage, and ransomware.
Known for its cross-platform capabilities, Gopher can target Windows, macOS, and Linux systems, making it a versatile and persistent threat for organizations of all sizes.
Gopher malware refers to a collection of malicious tools and families written in the Go (Golang) programming language.
AridViper has deployed multiple malware families in their campaigns, including Micropsia and Gopher; malware written in the Go language isn't new, with sightings dating back to at least 2012.
It can be compiled to run on Windows, macOS, and Linux operating systems with minimal changes to the code; attackers have deployed Gopher malware against various industries, including government, telecommunications, and financial services.
The Gopher name can be confusing because it refers to several distinct malware variants, and this flexibility allows attackers to target a wide range of environments.
It's not a single strain but a broad category of malware that shares a common development language.
For instance, Gopher Ransomware encrypts files and demands a ransom, while the Arid Gopher toolset is used by the threat actor group AridViper (also tracked as APT-C-23, Desert Falcon, and Two-tailed Scorpion) is credited with creating the Arid Gopher toolset.
Security firms like Intezer and Palo Alto Networks' Unit 42 began reporting on the dramatic rise of Go-based malware in 2020, highlighting its growing use in targeted and widespread campaigns.
For example, Check Point Research detailed a macOS variant in 2019.
Software Supply Chain Attacks: Threat actors may inject Gopher malware into legitimate software packages or updates, tricking users into installing it.
Exploitation of Vulnerabilities: Some Gopher variants spread by exploiting unpatched vulnerabilities in software and operating systems to gain initial access.
It may also check for the presence of virtual machines or sandboxes to avoid detection.
What happened
Gopher malware is a family of malicious software, often written in the Go (Golang) programming language, designed for various cyberattacks, including data theft, espionage, and ransomware.
Known for its cross-platform capabilities, Gopher can target Windows, macOS, and Linux systems, making it a versatile and persistent threat for organizations of all sizes.
Gopher malware refers to a collection of malicious tools and families written in the Go (Golang) programming language.
What changed
AridViper has deployed multiple malware families in their campaigns, including Micropsia and Gopher; malware written in the Go language isn't new, with sightings dating back to at least 2012.
Who is affected
It can be compiled to run on Windows, macOS, and Linux operating systems with minimal changes to the code; attackers have deployed Gopher malware against various industries, including government, telecommunications, and financial services.
Why it matters
The Gopher name can be confusing because it refers to several distinct malware variants, and this flexibility allows attackers to target a wide range of environments.
Technical details
It's not a single strain but a broad category of malware that shares a common development language.
For instance, Gopher Ransomware encrypts files and demands a ransom, while the Arid Gopher toolset is used by the threat actor group AridViper (also tracked as APT-C-23, Desert Falcon, and Two-tailed Scorpion) is credited with creating the Arid Gopher toolset.
Security firms like Intezer and Palo Alto Networks' Unit 42 began reporting on the dramatic rise of Go-based malware in 2020, highlighting its growing use in targeted and widespread campaigns.
Response
For example, Check Point Research detailed a macOS variant in 2019.
Software Supply Chain Attacks: Threat actors may inject Gopher malware into legitimate software packages or updates, tricking users into installing it.
What remains unknown
For many other Gopher variants, especially ransomware and commodity trojans, the identities and number of individuals behind them remain unknown.
Network Connections: Unusual outbound connections to unknown IP addresses or domains, especially over non-standard ports.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.