I'd also like to add that Go has the advantage that its ideology of using a "pure go until the syscall level" approach is what makes it an optimal malware devel

I'd also like to add that Go has the advantage that its ideology of using a "pure go until the syscall level" approach is what makes it an optimal malware development language. It's so much easier to develop and deploy malware because most of the EDR world focus heavily on the "C-like world" and its limitations. The only other project that comes close to what you can do with Go when it comes to mutating binaries is in my opinion the APE/cosmopolitan ecosystem. But those binaries tend to get flagged immediately because there's no major software that's being used that requires APE binaries to run. On the other hand, the static parts of any Go binary (the head/runtime part) can't be flagged because of so many devops tools rely on Go binaries to work. There was the Ebowla incident in 2016, where all go binaries (including docker) were flagged as malware because the static parts were added as yara rules in Kaspersky and other Antivirus tools. They had to revert those changes after a week.