Offensive Golang Bonanza: Writing Golang Malware
Ben Kurtz breaks down the mechanics of developing offensive Golang malware, demonstrating EDR evasion techniques, memory injection, and cross-platform compilation.
Summary
The Rapid Rise of Golang in Offensive Operations
Golang has emerged as a preferred language for red teams and nation-state threat actors due to its static binary compilation, cross-platform support, and rich standard library.
Core Building Blocks of Golang Implants
Ben Kurtz walks through developing robust offensive Golang components, from in-memory PE execution to encrypted command-and-control (C2) communications.
Bypassing Modern EDR and Network Monitoring
Kurtz demonstrates techniques for bypassing endpoint detection, including dynamic API unhooking, direct system calls in Go, and obfuscating runtime symbol tables.
Defensive Engineering and Hunting Golang Implants
The author provides defensive analysts with Yara signatures and binary analysis guidelines to deobfuscate and reverse engineer Go binaries.
Related talks
Creator Stage·48 min
Asher Davila
Examines the challenges of analyzing Go-based IoT malware and demonstrates reversing techniques using the Pumabot surveillance botnet as a case study.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Main Stage·37 min
Daniel Avinoam
Daniel Avinoam reverse engineers the Windows Containers minifilter driver, weaponizing native filesystem isolation to hide malicious files and evade EDR sensors.