Golem

Category: ransomware · Aliases: Trojan.Golem, Rootkit.Golem, Botnet.Golem, Win32/Golem · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-02T07:25:05Z

Category: RansomwareActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Golem is a sophisticated malicious Trojan and rootkit designed to covertly infiltrate Windows systems, establish deep persistence, and recruit the compromised endpoint into a botnet. Historically, "Golem" variants have been utilized by advanced threat actors to facilitate massive Distributed Denial of Service (DDoS) attacks, relay spam, or serve as a persistent backdoor for secondary payload delivery.

Infection Vector and Technical Capabilities

Golem is typically distributed via exploit kits that silently compromise vulnerable web browsers, through massive spear-phishing campaigns, or by brute-forcing weak RDP (Remote Desktop Protocol) credentials. Once executed, Golem focuses on stealth and network control:

Kernel-Level Rootkit: Advanced variants of Golem utilize kernel-mode drivers (rootkits) to intercept API calls. This allows the malware to completely hide its processes, files, and registry entries from the Windows Task Manager and traditional, user-mode antivirus scanners.
Botnet Recruitment: The primary function is to connect the endpoint to a centralized Command and Control (C2) server. The machine then quietly awaits instructions, allowing the attacker to utilize the collective processing power and bandwidth of thousands of infected machines simultaneously.
Secondary Payloads: Because Golem establishes a highly secure, hidden backdoor, the botnet operators frequently lease access to the infected machines to other criminal groups, who then utilize the Golem backdoor to deploy ransomware or info-stealers.

Threat Assessment

A Golem detection is a critical security incident. The presence of a rootkit implies that the operating system itself can no longer be trusted to accurately report its own state. The endpoint is actively contributing to malicious activity on the internet and is highly vulnerable to the deployment of secondary, destructive payloads.

Incident Response and Remediation

Immediate Network Isolation: The highest priority is to sever the connection to the C2 server by instantly isolating the infected endpoint from the LAN and the internet.
Memory Forensics and Offline Scanning: Because the rootkit hides the malware from the running OS, analysis and detection often require memory forensics (e.g., Volatility) or booting the machine from an offline, trusted OS (like a Linux Live USB) to scan the dormant hard drive.
Complete Re-imaging: Due to the kernel-level hooks established by the rootkit, attempting to "clean" the system is highly unreliable. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1014 T1055 T1543.003

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_GOLEM {
    meta:
        description = "Detects Golem (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "golem" ascii wide nocase
        $s2 = "trojan.golem" ascii wide nocase
        $s3 = "rootkit.golem" ascii wide nocase
        $s4 = "botnet.golem" ascii wide nocase
        $s5 = "win32/golem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Golem Activity
id: 62650cd9a5fb136dc137b155e4ae6f2a
status: experimental
description: Detects generic indicators of the golem malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*golem*"
            - "*trojan.golem*"
            - "*rootkit.golem*"
            - "*botnet.golem*"
            - "*win32/golem*"
    condition: selection
level: medium

References & External Analysis

Search "golem" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Golem Ransomware from Windows?

Manual removal of Golem is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Golem a virus or a Ransomware?

Golem is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Golem typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Golem infection?

Symptoms of Golem can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: ransomware)

Explore other malware families in the same category:

Protect Your Network Against Ransomwares

Want to prevent Golem and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/golem.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.