“The use of Golang for the wiper is an interesting choice — perhaps indicating further experimentation and efficiency in the attack process,” Hegel said. “The use of Go is quickly on the rise, as we see many APTs increasingly use it.”
Go has “many benefits for malware developers,” he said, including ease of cross-complication, which is “likely a particular interest to Sandworm.” The unit will likely continue developing new attacks as the war drags on, Hegel added. “I estimate we’ll see increasingly desperate and faster paced campaigns occur as western support for Ukraine expands.”