GolangGhost Go backdoor dropped to temp/appdata with outbound C2 beacon

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•10

Detects the creation of unrecognized Go-compiled binaries by common developer tools (e.g., node.exe, code.exe) in user-writable or temporary directories, followed shortly by outbound network connections to known C2 infrastructure (e.g., vercel.app, jsonkeeper.com). This behavior is consistent with the 'Contagious Interview' campaign attributed to the Lazarus Group.