New GoSerpent Malware Targets Southeast Asian Governments
Cybersecurity experts have uncovered a new malware called GoSerpent, which has been utilized in cyber attacks against Southeast Asian governments and diplomatic entities since late 2025. The Russian cybersecurity firm Kaspersky revealed the discovery in February 2026, highlighting the malware's focus on long-term access and intelligence gathering. GoSerpent is engineered to connect to an external server and deploy secondary payloads aimed at collecting sensitive data and dumping credentials from compromised systems.
In May 2026, the threat actors behind GoSerpent returned with an upgraded arsenal of malicious tools, including a new Stowaway RAT and a proxy tool that closely resembles the original malware. Additionally, they introduced a stealthy tool designed to exfiltrate sensitive data gathered over the preceding months through network shares. The primary objective of these operations is to harvest sensitive files and prepare them for exfiltration using a tool known as ThumbcacheService. Credential dumping tools are also employed to capture system credentials necessary for facilitating data exfiltration via network shared drives.
GoSerpent has roots in earlier iterations of Go-based implants and remote access trojans (RATs) that have been active since 2021, with recent variants surfacing as recently as this year. The malware operates by receiving encrypted and Base64-encoded command-line arguments, which include the command-and-control (C2) address and communication password. Once decrypted, the backdoor establishes a connection to the C2 server over an encrypted channel, utilizing the SHA256 hash of the communication password as the encryption key.
Kaspersky noted that GoSerpent can establish SOCKS5 proxy servers to route traffic through compromised hosts, allowing attackers to access other networks while concealing their true IP addresses. The backdoor can also deploy additional malicious tools, such as ThumbcacheService for file collection, Mimikatz for credential dumping, and QuarksDumpLocalHash for extracting local account password hashes.
After several months of covert data harvesting, the threat actors returned to the compromised environments in May 2026 to deploy another set of tools. Kaspersky expressed concern over the strategic deployment of various tools with advanced data collection and exfiltration capabilities, emphasizing the operational planning involved in the attacks.
While definitive attribution of the attacks remains uncertain, Kaspersky noted that the campaign shares similarities in targeting, technical capabilities, and operational methods with TetrisPhantom, a sophisticated threat actor first documented in October 2023 for targeting government entities in the Asia-Pacific region. This actor previously exploited secure USB drives protected by hardware encryption to harvest sensitive data from APAC government entities.
The disclosure of GoSerpent coincides with reports from Cyderes Howler Cell, which detailed a separate cyber espionage operation by DoNot Team targeting Bangladesh's military and defense sectors. This operation involved spear-phishing emails containing a malware-laden RTF document that deployed a DLL implant, establishing persistence disguised as OneDrive telemetry and communicating with a C2 server over HTTPS. Researchers noted that the RTF document employed remote template injection to fetch a VBA macro, with geofencing restricting payload delivery to victims within the target region. The macro execution led to the injection of architecture-aware shellcode through callback-based API abuse, facilitating further malicious activities.
