Report: the number of malware strains written in Go have increased by around 2,000% since 2017, after APTs and cybercrime groups adopted the language
There's been a 2,000% increase of new malware written in Go over the past few years. — The number of malware strains coded …
Context & Ripple Effects
The reported adoption of Go by APTs and cybercrime groups is an early signal that malicious-code development is broadening beyond established toolchains. Related coverage later tied the use of “exotic” languages such as Golang to harder analysis and detection evasion, giving the increase operational significance rather than treating it as a language-popularity metric.
The development sits within a changing intrusion mix: later CrowdStrike reporting found malware-free intrusions had become the majority of observed intrusions, so the growth of Go malware represents one branch of a wider diversification in attacker methods.
First-order effects
- Security analysts face a larger pool of Go-based samples to reverse-engineer, while APT and cybercrime groups gain a language choice associated in related coverage with impeding analysis and evading detection.
Second-order effects
- Detection vendors and enterprise security teams are pushed to ensure their malware-analysis and detection workflows cover Go alongside more familiar malicious-code ecosystems.
Third-order effects
- If attackers continue to diversify both programming languages and initial-access methods, defensive advantage shifts toward behavior-focused detection that is less dependent on recognizing a particular malware family or language.
The trend: Cyber intrusions are diversifying across both malware implementation languages and malware-free techniques, raising the value of defenses that identify attacker behavior rather than a single codebase.