Report: the number of malware strains written in Go have increased by around 2,000% since 2017, after APTs and cybercrime groups adopted the language
Context & Ripple Effects
The Go surge sits between two data points in the corpus: developers had already flagged Go as a language they wanted to learn — a HackerEarth survey put it ahead of Python months before this report — so threat actors were adopting a toolchain with a growing talent pool and rich standard library. Months later, researchers confirmed the motivation explicitly: malware writers use Go and other 'exotic' languages specifically to hamper analysis and evade detection.
First-order effects
- Antivirus engines and sandbox tools tuned for C-family binaries now face Go's bulky, runtime-embedded executables, forcing security vendors to rebuild detection signatures and analyst tooling around a new compiler output.
Second-order effects
- Go's native cross-compilation lets one codebase target Windows and Linux alike, feeding the broader run of malware aimed at Linux-based IoT systems that CrowdStrike measured rising 35% year over year in 2021.
Third-order effects
- As language choice becomes an evasion tactic rather than an engineering preference, defenders are pushed toward behavior-based detection — a shift consistent with CrowdStrike's later finding that most intrusions are now malware-free, which suggests the arms race fragments into compiled-malware evasion on one side and credential-based attacks that skip binaries entirely on the other.
The trend: Malware development is industrializing around mainstream, developer-friendly languages like Go, turning compiler choice itself into a defense-evasion technique.