A new Go-based ransomware is active

What defines the new Go-based ransomware and how does it differ from legacy variants?

The recent surge of ransomware written in the Go programming language introduces several architectural distinctions that influence both its operational footprint and defensive posture. Unlike traditional C/C++ or Python ransomware, Go binaries are statically linked, producing a single executable that contains all dependencies. This eliminates the need for external libraries at runtime, reducing the attack surface for dynamic analysis tools that rely on monitoring shared library calls.

Furthermore, the Go runtime includes a garbage collector and a scheduler that can obscure process behavior. The ransomware leverages Go’s concurrency primitives to spawn multiple goroutines, each handling a subset of files or network connections. This parallelism can accelerate encryption throughput while diluting per-thread activity, making signature-based detection more challenging.

Key distinguishing features include:

• Static binary with embedded resources.
• Use of Go’s standard library for cryptographic operations, specifically ChaCha8.
• Concurrent goroutine execution for file encryption and command-and-control (C2) communication.
• Obfuscation of strings and use of base64 encoding to hide malicious payloads.
• Integration with the TOR network for anonymized C2 channels.

These characteristics necessitate a shift from traditional detection paradigms toward behavior-based and network anomaly detection.

How does the ransomware implement ChaCha8 encryption and what are the forensic implications?

The ransomware employs the ChaCha8 stream cipher, a variant of the ChaCha family that processes 8 rounds instead of the standard 20. ChaCha8 offers a balance between speed and security, making it suitable for encrypting large volumes of data quickly. The implementation follows the standard ChaCha construction: a 256-bit key, a 96-bit nonce, and a 64-bit counter.

Forensic implications arise from the deterministic nature of ChaCha8. Each file is encrypted with a unique nonce derived from the file’s inode and a global counter. This approach ensures that identical plaintext blocks produce distinct ciphertexts, thwarting simple block substitution attacks. However, the deterministic nonce generation also creates a predictable pattern that can be leveraged for detection:

• File metadata changes: The ransomware records the original file size and modification timestamp before encryption. Post-encryption, the timestamp is altered to the current time, and the file size is increased by the padding added to align with the cipher block size.
• Checksum anomalies: The ransomware calculates a SHA-256 hash of the plaintext and stores it in a hidden metadata file. The presence of such a hash file, especially with a name that matches a known ransomware pattern, is a strong indicator of malicious activity.
• Nonce reuse detection: If the same nonce is observed across multiple files, it indicates a flaw in the nonce generation logic, which can be exploited for cryptanalysis. Security teams can monitor for nonce collisions as a detection vector.

By correlating these forensic artifacts, analysts can build a robust detection signature that does not rely solely on cryptographic primitives.

What network behaviors are characteristic of the ransomware’s TOR-based command-and-control?

The ransomware establishes a C2 channel over the TOR network to obfuscate its traffic and evade IP-based blocking. The following behaviors are typical:

• Outbound connections to .onion addresses using the TOR client embedded within the binary.
• Use of the SOCKS5 protocol to tunnel traffic through the TOR circuit.
• Periodic heartbeats to a set of hidden service endpoints, each identified by a unique onion address.
• Encrypted payloads transmitted over the TOR circuit, often base64-encoded to bypass content filters.
• Use of a custom protocol that mimics HTTP/HTTPS traffic, including random user-agent strings and TLS handshakes to further disguise the traffic.

Detection can be achieved by monitoring for outbound connections to .onion domains, inspecting the traffic for the presence of the SOCKS5 handshake, and flagging base64-encoded payloads that are transmitted over encrypted channels. Additionally, the ransomware’s heartbeats occur at irregular intervals, typically ranging from 5 to 30 minutes, which can be modeled as a Poisson process for anomaly detection.

How does the GREENBLOOD component integrate into the ransomware’s architecture?

GREENBLOOD is a modular component that the ransomware uses to manage its encryption keys and to orchestrate the execution of the encryption routine across multiple machines. It functions as a lightweight key management service (KMS) that operates over the TOR network. Key features include:

• Dynamic key rotation: GREENBLOOD generates a new 256-bit key for each victim machine, reducing the risk of key compromise.
• Key distribution: The key is transmitted to the victim machine via a secure channel, encrypted with the machine’s public key derived from a self-signed certificate.
• Audit logging: GREENBLOOD maintains a log of key issuance events, which can be retrieved by the attacker for persistence.
• Self-destruct mechanism: After a configurable timeout, GREENBLOOD deletes the key from memory and from the TOR hidden service, preventing post-mortem decryption.

From a defensive standpoint, monitoring for the creation of self-signed certificates and the presence of encrypted key files can provide early warning. Additionally, the self-destruct mechanism can be exploited to trigger a forensic snapshot before the key is purged.

What host-based indicators should security teams monitor for early detection?

Host-based detection relies on a combination of file system, registry, and process monitoring. The following indicators are recommended:

• Creation of a hidden file named ~$GREENBLOOD.key in the user’s Documents folder.
• Modification of the AppData\Local\Temp directory with files that contain the string “ChaCha8” in their metadata.
• Execution of a process named go-ransom.exe that spawns more than 10 goroutines within the first minute of launch.
• Alteration of file timestamps to the current system time without corresponding user activity.
• Presence of a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to the ransomware binary.
• Network connections to .onion domains with a destination port of 9050 (default TOR SOCKS port).

Implementing real-time monitoring of these indicators using an endpoint detection and response (EDR) platform can reduce the time to detection (TTD) to under five minutes.

How can YARA rules be crafted to detect the ransomware’s binary and artifacts?

YARA provides a flexible framework for pattern matching within binaries and files. The following rule set targets the ransomware’s unique characteristics:

rule GoRansomware_Detection
{
    meta:
        description = "Detects Go-based ransomware with ChaCha8 encryption and TOR C2"
        author = "OCSALY Academy"
        last_modified = "2026-02-05"

    strings:
        $go_runtime = "runtime" nocase
        $chacha8 = "ChaCha8" nocase
        $tor_socks = "SOCKS5" nocase
        $greenblood = "GREENBLOOD" nocase
        $onion = ".onion" nocase
        $heartbeat = "heartbeat" nocase
        $key_file = "~$GREENBLOOD.key" nocase

    condition:
        all of ($go_runtime, $chacha8, $tor_socks) and
        any of ($greenblood, $onion, $heartbeat, $key_file)
}

rule GoRansomware_Detection
{
    meta:
        description = "Detects Go-based ransomware with ChaCha8 encryption and TOR C2"
        author = "OCSALY Academy"
        last_modified = "2026-02-05"

    strings:
        $go_runtime = "runtime" nocase
        $chacha8 = "ChaCha8" nocase
        $tor_socks = "SOCKS5" nocase
        $greenblood = "GREENBLOOD" nocase
        $onion = ".onion" nocase
        $heartbeat = "heartbeat" nocase
        $key_file = "~$GREENBLOOD.key" nocase

    condition:
        all of ($go_runtime, $chacha8, $tor_socks) and
        any of ($greenblood, $onion, $heartbeat, $key_file)
}

Deploying this rule across file integrity monitoring (FIM) and endpoint scanners will flag both the binary and its associated artifacts. The rule can be extended with entropy checks to detect high-entropy encrypted files.

What network-based detection strategies are effective against TOR-based C2 traffic?

Network detection focuses on identifying anomalous traffic patterns that deviate from baseline behavior. Effective strategies include:

• Deep packet inspection (DPI) for the SOCKS5 handshake, which is uncommon in typical corporate traffic.
• Statistical analysis of outbound traffic volume to .onion domains, with thresholds set at the 95th percentile of normal usage.
• Correlation of TLS handshake anomalies, such as the use of self-signed certificates or unusual cipher suites.
• Implementation of a honeypot TOR hidden service that mimics the ransomware’s C2 endpoint, capturing the attacker’s traffic for analysis.
• Use of machine learning classifiers trained on benign TOR traffic versus malicious TOR traffic to detect subtle differences in packet timing and size.

Combining these techniques with a real-time alerting system can provide early warning before the ransomware completes its encryption cycle.

How should incident response teams handle a suspected infection?

Incident response should follow a structured approach to contain, eradicate, and recover from the ransomware:

• Containment: Isolate the infected host from the network to prevent lateral movement. Disable the TOR client service and block outbound connections to .onion domains.
• Eradication: Remove the ransomware binary, delete the key file, and purge any scheduled tasks or registry entries created by the malware.
• Recovery: Restore encrypted files from backups. If backups are unavailable, consider using forensic decryption tools that exploit nonce reuse or weak key management if applicable.
• Post-incident analysis: Conduct a root cause analysis to identify how the ransomware entered the environment. Review email logs, web proxy logs, and user activity for initial compromise vectors.
• Reporting: Document all findings, including timestamps, affected systems, and remediation steps. If required, report the incident to relevant authorities and stakeholders.

Maintaining a detailed incident playbook that incorporates these steps ensures consistency and reduces the likelihood of recurrence.

What preventive measures can organizations implement to mitigate the risk of Go-based ransomware?

Prevention requires a multi-layered defense strategy:

• Patch management: Keep operating systems and applications up to date to close known vulnerabilities that could be exploited for initial access.
• Application whitelisting: Enforce strict controls on executable execution, allowing only signed binaries from trusted sources.
• Network segmentation: Isolate critical assets and restrict outbound traffic to only necessary protocols and destinations.
• Endpoint hardening: Disable unnecessary services such as the TOR client and restrict the creation of hidden files.
• Security awareness training: Educate users on phishing and social engineering tactics that are common vectors for ransomware delivery.
• Regular backups: Implement immutable backup solutions that are isolated from the network to ensure data availability in the event of encryption.

By integrating these controls into the security architecture, organizations can significantly reduce the attack surface for Go-based ransomware.

Protocol/Artifact Reference

Below is a concise reference of protocols, artifacts, and detection points associated with the Go-based ransomware:

• Encryption: ChaCha8 stream cipher, 256-bit key, 96-bit nonce.
• C2 Protocol: TOR hidden services (.onion), SOCKS5, base64-encoded payloads.
• Key Management: GREENBLOOD component, self-signed certificates, key rotation.
• Artifacts: Hidden key file (~$GREENBLOOD.key), metadata hash file, modified timestamps.
• Detection: YARA rule (GoRansomware_Detection), DPI for SOCKS5, entropy analysis, process monitoring.
• Mitigation: Endpoint isolation, TOR client disablement, network segmentation, immutable backups.

Security teams should reference this table when configuring detection rules, updating incident response playbooks, and conducting threat hunting exercises related to Go-based ransomware.