New Titan Stealer: customizable Golang malware that steals information

Words like Golang and Titan stealer may seem ominous, let’s take another look at these terms.

What is Golang?

Golang is a mix-up between the words of Go and programming language, This is a programming language developed by google. It was created as an alternative to C++ and Java, with a focus on simplicity, efficiency, and scalability. Go has gained popularity in recent years, especially in the field of web development, network programming, and cloud computing.
In terms of cybersecurity, Golang is becoming increasingly significant due to its use in the development of various malicious tools and malware. Threat actors are leveraging the language’s efficient performance, fast compilation time, and ability to run on various platforms to create malware that can evade detection and compromise sensitive information.

Titan Stealer: Unique Information-Grabbing Malware

What sets Titan apart is that it is offered in a customizable form, known as a “builder.” This means that customers can tailor the malware to their specific needs by choosing what types of information they want to steal and what functionalities they want the malware to have. Once the malware infects a system, it can persist and collect this sensitive information, exfiltrating it to the attacker’s server.
According to a recent report by security researchers Karthickkumar Kathiresan and Shilpesh Trivedi of Uptycs.”The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files.

Some major web browsers that Titan Stealer targets are Google Chrome, Mozilla Firefox, Microsoft Edge, Yandex, Opera, Brave, Vivaldi, 7 Star Browser, Iridium Browser, and others. The crypto wallets singled out are Armory, Atomic, Bytecoin, Coinomi, Edge Wallet, Ethereum, Exodus, Guarda, Jaxx Liberty, and Zcash.

Here is what makes Titan Stealer Interesting, it is currently unknown how Titan Stealer malware is being distributed, but it is commonly known that attackers use various tactics such as phishing, malicious advertisements, and distributing cracked software to spread malware.

What Can You Do?

It is important to be aware of the signs of a potential infection, such as slow system performance, unexpected pop-ups, and strange network activity.  Staying aware and up-to-date on current cyber threats keeps you one step ahead. If you suspect that you have been infected with Titan Stealer or any other malware, it is recommended to seek assistance from a trusted security professional to remove the infection and prevent further data loss.

As always, if you have any reason to believe your organization is under attack, or like to insure all your software is free of security exploits.  Please do not hesitate to contact our incident response team.