GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments
Do Son 
At a glance
| Malware family | GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload |
| Threat actor | Unconfirmed. Kaspersky notes a possible link to TetrisPhantom. |
| Target / victims | Government and diplomatic entities in Southeast Asia |
| Delivery vector | Not disclosed. GoSerpent runs as the first-stage foothold. |
| Key capabilities | SOCKS5 proxying, credential dumping, staged file collection, network-share exfiltration |
| Source | Kaspersky GReAT (Securelist) |
TL;DR
Kaspersky’s GReAT team disclosed a long-running cyber espionage campaign built around the GoSerpent backdoor on July 16, 2026. The Go-based tool has hit Southeast Asian government and diplomatic networks since at least 2021. Its operators steal documents and credentials, then wait weeks before exfiltrating.
Why it matters
Patience is the story here. The operators drop a foothold, then sit still. As Kaspersky’s Noushin Shabab explains, the group lets “the dust settle for weeks before deploying their secondary exfiltration tools.” That dwell time is a deliberate move to outlast log retention.
The targets raise the stakes. Reporting indicates the haul spans government files, biometric databases, and diplomatic records. Kaspersky frames the campaign around long-term access and intelligence gathering.
Delivery
Kaspersky did not disclose the initial infection vector. The GoSerpent backdoor itself serves as the first stage. It reads encrypted, base64-encoded command-line arguments that hold a C2 address and a communication password.
Infection chain
The campaign runs in two phases. In the first, GoSerpent lands and stays quiet. After several days, it pulls in helper tools.
A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin. Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.
The second wave
The operators returned in May 2026 with fresh tooling. A new Go-based RAT named Stowaway took the lead. It adds reverse tunneling and SSH-based tunneling on top of the proxy features.
Stowaway then delivered the exfiltration piece: TmcLoader and its embedded TmcPayload. Per Kaspersky, “TmcLoader is a stealthy C++ loader module registered as a Windows service.” It decrypts the payload straight into svchost memory to stay hidden.
Command-and-control and exfiltration
GoSerpent encrypts its C2 traffic with ChaCha20. It can also spin up SOCKS5 proxies to route traffic through victims and hide the operator’s real IP. The tools even reuse legitimate domain names as secret keys for cover.
The exfiltration design shows tight integration. TmcPayload reads a config file holding network-share credentials and destinations. It then ships out the exact database that ThumbcacheService built. Stolen credentials from phase one make that quiet, share-based transfer possible.
For hosting, the operators lean on Alibaba Cloud and UCLOUD HK. Legitimate providers help the traffic blend in.
Attribution
Attribution stays open. Kaspersky states the exact attribution “remains uncertain.” However, the team notes a possible link to the TetrisPhantom actor, based on shared victims, tooling, and methods. No group is confirmed, and no named individuals are involved.
Detection and defense guidance
Hunt for the campaign’s fingerprints. Check the Public user folder for the staging database and odd password-protected archives. Audit new Windows services that load DLLs mimicking system components.
Watch svchost processes for outbound traffic to the published C2 addresses. Because this cyber espionage operation waits weeks between steps, extend log retention and connect old alerts to new activity. Kaspersky published file hashes and 11 C2 IPs, so defenders can start hunting today.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
