GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers have published a detailed technical analysis of a custom Go agent for the Mythic C2 framework used by the Russian-oriented APT group GOFFEE (Paper Werewolf). The implant, internally named COW, was discovered on compromised Linux servers during an incident response investigation and represents a standalone development branch forked from the public Poseidon agent rather than its Freyja derivative.
Initial Discovery and Obfuscation
During one investigation, the team identified servers where attackers had established persistence using Go-based Mythic agents. The binaries were protected with Garble obfuscation and packed with a modified version of UPX. Standard UPX unpacking failed because service headers had been partially removed or corrupted, requiring manual restoration of the packer structures. Even after unpacking, Garble had stripped most original function, package, and type names, complicating static analysis.
Origin from Poseidon
Initial indicators pointed to Poseidon, previously observed in GOFFEE operations. Comparison with public Poseidon and Freyja codebases revealed that COW is not a direct copy of either. A surviving file path in an early unobfuscated sample, /Mythic/agent_code/pkg/utils/p2p/poseidon_tcp.go, confirmed the Poseidon codebase as the direct ancestor. Additional architectural similarities in profile handling, Mythic tasking logic, and P2P module structure reinforced this conclusion.
Key Differences and Enhancements
Researchers documented multiple deviations from public Poseidon and Freyja versions:
- Configuration continues to use ldflags instead of the later Base64/JSON approach adopted by the public projects.
- Support for additional addresses inside HTTP profiles not present in Poseidon or Freyja.
- Custom P2P implementation (p2p_tcp) with compatibility for Poseidon and webshell-based communication.
- Expanded Windows capabilities including registry manipulation, .NET execution, screenshot capture, and persistence mechanisms.
- Platform-specific command sets for both Linux and Windows environments.
These changes were observed across multiple related samples, indicating stable, intentional modifications rather than one-off build variations.
Additional Samples and Attribution
Retrospective searches on VirusTotal using surviving strings and build parameters located several additional Linux and Windows builds. Some samples lacked Garble obfuscation, preserving package and function names that aided further comparison. Attribution to GOFFEE was established through matching C2 infrastructure previously linked to the group in public incident reports, not merely code similarity.
Group Context
GOFFEE has conducted targeted espionage operations since at least 2022, primarily via spear-phishing with RAR archives, malicious Office documents, and HTA files. The group targets government organizations, energy, telecom, media, construction, industry, and defense sectors. Its toolkit includes PowerTaskel, PowerModul, MiRat, Sauropsida, BindSycler, DQuic, and a modified Owowa component, with heavy use of Garble, Ebowla, and custom encryption for evasion.
Related articles
Cybercriminals Distribute NJRAT, DCRAT and Chaos via Fake GTA 6 Downloads
Threat actors are leveraging anticipation around GTA 6 to spread multiple malware families through fake game downloads. Security researchers at Huntress identified campaigns that combine search-engine poisoning, gaming forums, torrent sites and social-media posts to deliver oversized fake ISO files exceeding 100 GB. Victims who execute the installer see Russian-language messages claiming an invalid crack or missing license, while remote-access tools and data stealers run silently in the background. The delivered payloads include NJRAT and DCRAT for keystroke logging, screen capture and webcam access, Mercurial Grabber for harvesting browser credentials and Discord tokens, and the Chaos wiper that encrypts small files and overwrites larger ones. The operation primarily targets Russian-speaking gamers, as indicated by the ransom note and error messages. Analysts recommend avoiding unofficial downloads and isolating any compromised systems immediately.
Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access
Modern smartphones continue gathering sensor data including microphone, camera, gyroscope, and satellite navigation even when Wi-Fi and mobile data are disabled. Information is stored locally and transmitted only when connectivity is restored. The Find My Device feature from Google and Find My from Apple allow location reporting for hours after the device is powered off via a separate Bluetooth chip. In August 2026, ThreatFabric disclosed the Manic trojan that uses Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT to relay encrypted data through nearby infected devices when direct internet access is unavailable. The malware supports multi-hop routing of up to four intermediate devices. Everyday users face greater risk from over-privileged applications and pre-installed malware on gray-market devices than from sophisticated offline exfiltration techniques. A detailed checklist covers purchase hygiene, permission audits, and recovery steps after suspected compromise.
Reconstructed Stuxnet Source Code Published on GitHub with Build Instructions
An unknown researcher has released a reconstructed version of the Stuxnet worm source code on GitHub, including reverse-engineering results and assembly instructions. Stuxnet was discovered in 2010 and is widely attributed to the joint US-Israeli Olympic Games operation targeting Iran's Natanz uranium enrichment facility. The malware specifically attacked Siemens industrial controllers by altering frequency converter operations to physically damage centrifuge rotors while falsifying operator displays. Propagation relied on USB drives, network shares, and a Windows Print Spooler vulnerability, combined with stolen Realtek and JMicron driver-signing certificates. The worm also injected itself into Siemens WinCC and Step 7 software to intercept communications with programmable logic controllers. Due to a flaw in its environment checks, Stuxnet escaped the target network and spread publicly before its built-in June 2012 self-destruct date. Researchers are advised to analyze the code only inside fully isolated virtual machines without network access.
Researchers Create 0-Click WeChat Worm That Hijacks Accounts via Incoming Calls
Security researchers at Calif have developed a 0-click worm capable of compromising WeChat accounts through incoming voice calls without any user interaction. The exploit requires only that the attacker already exists in the victim's contact list and works across Android and iOS devices. In demonstrations, an infected Android device called an iPhone to seize control of its WeChat account while the call continued ringing, after which the compromised iPhone targeted another Android device. The worm spreads automatically between trusted contacts, functioning like a classic network worm but using WeChat profiles as propagation nodes. Even if the victim answers or declines the call, the exploit can persist or be retried, for example during nighttime hours. After account takeover, attackers gain full control to read and send messages, make calls, and impersonate the owner, while the underlying smartphone itself remains unaffected. Tencent received notification in July, released patches in versions 8.0.77 for Android and 8.0.76 for iOS, and server-side blocking was confirmed by late August, with no real-world attacks observed so far.