The Sofacy threat group continues to carry out attacks using their Zebrocy tool. We have seen two separate attacks deliver the Go variant of Zebrobcy. The first attack occurred on October 11 and relied on a spear-phishing email with an LNK shortcut attachment. We believe the threat group uses multiple languages to create their Trojans to make them differ structurally and visually to make detection more difficult. The use of a different programming language to create a functionally similar Trojan is not new to this group.”]
Source: https://unit42.paloaltonetworks.com/sofacy-creates-new-go-variant-of-zebrocy-tool/