The Allure of Go's Cross-Platform Capability: A Gateway for Threat Actors to Mac and Linux

The Allure of Go's Cross-Platform Capability: A Gateway for Threat Actors to Mac and Linux

Speakers: Anmol Maurya, Malware and Threat Researcher, Paletto Networks

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=GKHmNI6hLsI

Overview

In an insightful presentation at BSides NYC, Anmol Maurya, a malware and threat researcher at Paletto Networks (formerly with CrowdStrike), unveiled the growing trend of threat actors leveraging Golang's inherent cross-platform capabilities to target macOS and Linux systems. While the security industry's telemetry often heavily favors Windows-centric threats, Maurya's talk highlighted a significant and increasing shift towards Go-based malware impacting alternative operating systems. This discussion is critical for defenders, as Golang's unique features, such as static linking and straightforward cross-compilation, provide adversaries with a potent tool for developing highly portable and often stealthy malicious payloads.

The talk delved into the technical underpinnings of why Go is so appealing to malicious actors, examining how its design facilitates the creation of single codebases that can execute across different environments with minimal modification. Maurya showcased real-world examples of Go malware families, illustrating their capabilities and the specific Go libraries and routines they exploit. Furthermore, he provided a comprehensive guide for security professionals on how to effectively reverse engineer, analyze, and, most importantly, detect these sophisticated Go-based threats, emphasizing techniques tailored to the language's unique characteristics.

This deep dive into Golang malware on Mac and Linux is highly relevant given the observed 60% increase in Go malware telemetry over the last two years. As the adoption of non-Windows operating systems continues to grow in enterprise and personal environments, understanding the evolving threat landscape and the specific challenges posed by Go-compiled binaries is paramount for bolstering defensive postures and developing robust detection strategies against this emerging class of multi-platform threats.

Background

▶ Watch: Introduction to Golang malware on Mac/Linux (0:00)

The increasing adoption of Golang (Go) by threat actors stems directly from its design philosophy, which prioritizes simplicity, efficiency, and powerful cross-platform capabilities. Go's appeal to developers – the ability to "write code once and use it everywhere" – is precisely what makes it a formidable tool in the hands of adversaries. Key features contributing to this include static linking, where all necessary libraries are bundled directly into the compiled binary, and native cross-compilation, allowing a single codebase to be compiled for different operating systems and architectures (e.g., Linux AMD64, macOS ARM64) simply by setting environment variables like GOOS and GOARCH. This eliminates the need for complex build environments or separate codebases for each target, streamlining malware development and deployment.

Historically, the focus of malware research and detection has predominantly been on Windows platforms, accounting for an estimated 80% of observed telemetry. However, Maurya highlighted a significant shift, noting that within the Go malware ecosystem, the distribution is markedly different: approximately 20% targets macOS, 33-34% targets Linux, and a substantial 46-47% are designed to operate on both platforms, underscoring the language's inherent versatility. This trend is not new, with threat actors steadily increasing their use of Go over the past four to five years, culminating in an almost 60% increase in Go malware telemetry in the last two years alone.

From a defender's perspective, Go binaries present unique challenges. Due to static linking, Go malware samples are often significantly larger than their counterparts written in other languages, commonly exceeding 4MB, with some reaching 10MB or more. This substantial size can inadvertently enable detection evasion, as some legacy or less sophisticated antivirus (AV) and endpoint detection and response (EDR) solutions may have file size limitations for scanning, allowing larger Go binaries to bypass initial scrutiny. Additionally, threat actors frequently strip binaries and employ basic obfuscation techniques, further hindering initial static analysis. Common Go malware families observed in the wild include ransomware, red botnets, crypto miners, and tools used in supply chain attacks, such as Citulus, Zorat, BorderGo, and Jinx, each leveraging Go's capabilities for specific malicious objectives.

Key Findings

▶ Watch: Why Golang malware challenges traditional detection methods (3:00)

Anmol Maurya's presentation illuminated several critical findings regarding the burgeoning landscape of Golang malware targeting macOS and Linux environments. These findings collectively underscore the evolving challenges for cybersecurity professionals and the growing sophistication of threat actors.

Firstly, the core finding is the accelerated adoption of Golang by threat actors primarily due to its native cross-platform compilation and static linking capabilities. These features enable adversaries to efficiently develop and deploy a single malware codebase that can seamlessly operate across diverse operating systems like macOS and Linux, significantly reducing development overhead and increasing campaign scalability. This trend is evidenced by a 60% increase in Go malware telemetry targeting these platforms over the past two years, indicating a clear strategic shift by malicious actors.

Secondly, Go-compiled malware binaries inherently possess large file sizes, often exceeding 4MB. This characteristic, a direct consequence of static linking, presents an unexpected advantage for threat actors, as it can inadvertently bypass file-size-based scanning limitations in some traditional AV/EDR solutions. This finding highlights a gap in certain defensive technologies that need to adapt to the unique footprint of Go executables.

Thirdly, the talk detailed how threat actors exploit common Go standard libraries and third-party modules to implement sophisticated malicious functionalities. Examples included the widespread use of os/user for information gathering, exec.Command for executing arbitrary commands (e.g., credential dumping, screenshot capture, persistence), net.Listen for establishing backdoors, and the Telegram Bot API (tgbotapi) for robust command-and-control (C2) communication and data exfiltration. These findings demonstrate that adversaries are not developing entirely new capabilities but rather repurposing existing, legitimate Go functionalities for malicious ends.

Finally, Maurya's case studies illustrated the diverse applications of Go malware. From the Citulus stealer on macOS, which targets browser data and utilizes AppleScript for credential dumping and Telegram for exfiltration, to the BorderGo IoT exploitation framework that can launch over 30 exploits concurrently, and the Jinx red teaming tool known for its memory safety and real-time Telegram notifications, the findings reveal a broad spectrum of Go's utility in the adversarial toolkit. These examples underscore the versatility of Go for various attack types, from information theft to large-scale botnet operations and penetration testing.

Technical Deep Dive

▶ Watch: The growing trend of Go malware targeting Mac/Linux (4:30)

The technical core of Anmol Maurya’s presentation revolved around dissecting the characteristics of Golang binaries and outlining effective strategies for their analysis and detection. Understanding Go's unique compilation model is paramount for defenders.

Go Binary Characteristics and Initial Identification:

Go binaries are notoriously large, frequently exceeding 4 MB in size, a direct consequence of static linking. This means the executable bundles all necessary runtime components and libraries, making it self-contained but also bulky. To identify a Go binary, researchers should look for specific markers:

• Sections/Symbols: The presence of .go.pclntab (Go Program Counter Line Number Table) and go.buildinfo sections, along with symbols like runtime.main, are strong indicators.
• Tools: Utilities like gom, go-resolver, or even basic strings commands can reveal go.buildinfo and the Go version used for compilation. Modern disassemblers like IDA Pro and Ghidra have improved Go support, but understanding these fundamental markers is crucial.

Reversing Go Binaries: A Methodical Approach:

Maurya emphasized a structured approach to reversing Go malware:

1. Static Analysis First: Before dynamic execution, perform thorough static analysis. This involves identifying the Go binary characteristics mentioned above.
2. Locate Main Functions: In a Go binary, the execution typically starts in main.main or main.init. Unlike C/C++ where main is often the sole entry point, Go binaries can have many functions. Focusing on main.main is the most efficient starting point to understand the primary logic.
3. Tracing External Calls: If main.main is heavily obfuscated or not immediately revealing, researchers should pivot to tracing external calls. Malicious functionalities often rely on system calls or standard library functions. For example, by searching for cross-references to exec.Command (used for executing shell commands), one can often trace back to the malicious logic. Maurya provided an example where tracing exec.Command led to a function named sunshine_lip_kill_linux, clearly indicating its intent to terminate Linux services.
4. Debugging: Debugging Go malware is similar to other binaries but requires a focused approach. Start debugging from the main functions. Tools like x64dbg (for Windows) or native debuggers on Linux/macOS can be used. Maurya suggested using IDA plugins that copy comments and function names to the debugger to aid the process.

Case Studies: Go in the Wild

Maurya presented several compelling case studies illustrating how threat actors exploit Go's features:

• Citulus Stealer (macOS):
• Targets: Chrome, Firefox, and other browser-related data.
• Capabilities:
• Credential Dumping: Leverages OSAScript (AppleScript) via exec.Command to prompt users with dialogue boxes for credentials.
• Keychain Dumping: Also uses exec.Command to extract keychain data.
• Information Gathering: Employs the os/user package to collect username, hostname, IP addresses, and OS version.
• Exfiltration: Utilizes the Telegram API for C2 communication and exfiltration of stolen data, often zipping collected data before sending.
• Obfuscation: Basic Base64 encoding is used, particularly for C2 URLs, to hinder detection.

• Zorat (Linux):
• Capabilities:
• File System Enumeration: Uses filepath package for navigating and identifying files.
• File Exfiltration: Employs the TGbot API NewDocument function to send stolen files to Telegram channels.
• Screenshot Capture: Achieved via exec.Command to execute screenshot utilities.
• System Persistence: Implements various persistence mechanisms on Linux.

• BorderGo (IoT Exploitation):
• This botnet targets IoT devices.
• Key Feature: Demonstrates Go's concurrency by launching 30+ exploits simultaneously using Go functions.
• Backdoor Implementation: Creates backdoors with remarkable simplicity, requiring just two lines of code using net.Listen.

• Jinx (Pentest/Red Teaming Tool):
• Often found in Kali Linux, this tool is adopted by red teams and, by extension, threat actors.
• Advantages of Go for Jinx:
• Memory Safety: Prevents crashes during high-volume operations like phishing campaigns.
• Cross-Platform: A single codebase runs on Linux, Windows, and macOS.
• Telegram Integration: Uses TGbot API NewMessage for real-time notifications and exfiltration of captured sessions.
• Real-time Proxy Hunting: Implemented using Go's http server capabilities.

These case studies collectively illustrate that threat actors are adept at leveraging Go's robust standard library and popular third-party modules to build efficient, multi-platform malware with diverse functionalities.

Demo / Proof of Concept

▶ Watch: Case study: Deep dive into the Mac OS Citulu Stealer (7:00)

While the talk did not include a live demonstration or a full proof-of-concept, the speaker presented several code snippets and logical flowcharts to illustrate how Go's features could be leveraged for both benign and malicious purposes. These examples included basic Go code for cross-platform persistence (Mac launch agent, Linux autostart), a simple Base64 encoding script for obfuscation, and implementations of concurrent exploit execution and basic backdoor listening using Go functions and net.Listen. These conceptual examples served to visually reinforce the technical explanations of how Go's capabilities translate into practical adversarial techniques.

Defensive Implications

▶ Watch: Citulu Stealer's specific capabilities: data exfiltration and C2 (8:00)

The rise of Golang malware necessitates a recalibration of defensive strategies, moving beyond traditional Windows-centric approaches and incorporating Go-specific analysis techniques. Maurya outlined several key defensive implications:

1. Static Detection Enhancements:

• Go Binary Analysis: Defenders must explicitly look for Go-specific artifacts. This includes identifying the go.buildid and go.buildinfo sections, as well as specific Go runtime symbols (runtime.main, .go.pclntab). Tools capable of parsing Go binaries are essential.
• Go Versioning: Extracting the Go compiler version from binaries can be a powerful hunting indicator. Threat actors often stick to specific versions or use older ones, which can be fingerprinted.
• String Analysis: While basic, extracting strings can reveal C2 domains, file paths, or specific Go package names used by the malware.
• IOC Generation: Traditional IOCs like file hashes remain relevant. However, imphash (import hash) is largely ineffective for Go binaries due to their static linking, which results in a very different import table structure compared to dynamically linked executables.
• YARA Rules: Developing specific YARA rules targeting Go binary characteristics is crucial. Anmol Maurya provided a basic example rule looking for go.buildid and main.main functions, which can serve as a baseline for identifying potential Go malware.

2. Platform-Specific Monitoring:

• macOS Specific:
• Code Signing Violation: Most legitimate macOS applications are signed. Unsigned or ad-hoc signed Go binaries are highly suspicious and warrant immediate investigation.
• SIP Monitoring: Implement robust logging and monitoring for System Integrity Protection (SIP) violations, as malware often attempts to bypass or interact with protected system areas.
• Gatekeeper and Notarization Anomalies: Monitor for binaries that circumvent Apple's Gatekeeper or notarization processes, which are designed to prevent untrusted software from running.

• Linux Specific:
• System Call Monitoring: Tools like strace, ptrace, and especially eBPF (Extended Berkeley Packet Filter) are vital. eBPF provides unparalleled low-level system call observability, allowing defenders to monitor Go-specific runtime behaviors, such as calls to _r0_go_wait or clone functions, which are heavily utilized in Go's concurrency model.
• ELF Binary Analysis: Deep analysis of the ELF (Executable and Linkable Format) structure can reveal anomalies.
• Systemd Monitoring: Keep an eye on systemd unit file modifications for persistence.

3. Advanced Detection Techniques:

• Go Runtime Detection: Develop detection logic that understands and monitors the unique runtime behavior of Go applications.
• Supply Chain Monitoring: Given that Go projects often rely on numerous third-party modules, supply chain attacks leveraging malicious Go modules are a significant threat. Organizations should actively scan public repositories (GitHub, GitLab) for suspicious Go modules or dependencies used in their software development.

4. Future-Proofing Defenses:

• AI/LLM-Enhanced Threat Intelligence: While LLMs can generate basic malware, they also hold promise for accelerating threat intelligence analysis and detection rule generation.
• eBPF Enhanced Observability: Continued investment in eBPF for deep, low-overhead monitoring of system calls and Go runtime specifics across Linux environments.
• Multi-Platform Threat Intelligence Sharing: Due to Go's cross-platform nature, detection rules and threat intelligence for one platform can often be adapted and shared to protect other platforms, fostering a more collaborative and efficient defense ecosystem.

Key Takeaways

• Go's Cross-Platform Nature is a Double-Edged Sword: Golang's static linking and easy cross-compilation are highly attractive to threat actors, enabling them to create single malware codebases that effectively target both macOS and Linux environments, leading to a significant increase in multi-platform threats.
• Large Binary Sizes Pose Detection Challenges: Go-compiled malware often results in large binaries (4MB+), a characteristic that can inadvertently bypass file-size-based scanning limitations in some traditional AV/EDR solutions, necessitating updated detection logic.
• Specialized Analysis Techniques are Required: Effective analysis of Go malware demands Go-specific knowledge, focusing on identifying go.buildid, go.buildinfo, main functions, and tracing external calls, as traditional imphash techniques are largely ineffective.
• eBPF is Crucial for Linux Defense: For Linux systems, eBPF offers superior low-level system call monitoring, allowing defenders to observe Go-specific runtime behaviors (e.g., _r0_go_wait, clone functions) that are key indicators of malicious activity.
• Supply Chain Attacks are a Growing Concern: The reliance of Go projects on numerous modules makes them susceptible to supply chain attacks. Continuous monitoring of public repositories for malicious Go modules and robust dependency verification are essential.
• Leverage Cross-Platform Threat Intelligence: Due to Go's inherent portability, threat intelligence and detection rules developed for one platform can often be adapted and applied to others, promoting more efficient and comprehensive defensive strategies.

About the Speaker(s)

Anmol Maurya is a dedicated malware and threat researcher currently working at Paletto Networks. Prior to his role at Paletto Networks, Anmol contributed his expertise to CrowdStrike. His daily work involves in-depth analysis of malware samples and tracking evolving threat landscapes. Beyond his professional pursuits in cybersecurity, Anmol enjoys trekking and exploring mountains, particularly in the Himalayas.