A newly documented Go-based implant spent months quietly harvesting files from government and diplomatic networks across Southeast Asia before its operators returned with a more capable exfiltration toolkit.
Intelligence Lead
Security researchers at Kaspersky have disclosed a long-running espionage campaign built around a previously undocumented backdoor named GoSerpent, active against Southeast Asian government and diplomatic entities since at least late 2025. The operation's patience is its defining feature: attackers staged stolen files locally for weeks before exfiltrating them, and in May 2026 returned to compromised networks with an upgraded toolset, indicating sustained, well-resourced access rather than a single opportunistic intrusion.
Situation Report
Kaspersky first identified GoSerpent activity in February 2026, tracing the intrusion set back to at least late 2025. The malware, a Go-based remote access trojan with proxy capabilities, is deployed as an initial foothold and then used to install a secondary tool called ThumbcacheService, which scans infected machines for documents in common office formats, including files an operator had already deleted to the Recycle Bin, before archiving them locally with a password-protected 7-Zip container. Alongside file collection, the operators deployed Mimikatz to dump credentials from LSASS memory and QuarksDumpLocalHash to extract password hashes from the Windows SAM registry hive, building a credential set later used to move stolen archives across network shares.
In May 2026, the same operators returned to previously compromised environments with an evolved toolkit built around Stowaway, a proxy and remote-access framework supporting SOCKS5 proxying, reverse tunneling, and SSH-based access, paired with a loader-and-payload chain named TmcLoader and TmcPayload. TmcLoader decrypts its payload directly into the memory of a legitimate Windows process, a technique intended to defeat file-based antivirus detection, and TmcPayload is configured to retrieve the specific archive staged months earlier by ThumbcacheService, linking the initial collection phase directly to the later exfiltration run.
Kaspersky researcher Noushin Shabab confirmed the toolchain's operational sophistication, and separate reporting from GBHackers identified the command-and-control infrastructure as hosted on legitimate cloud platforms, including Alibaba Cloud and UCLOUD HK, with malware samples using recognizable domains such as microsoft.com and spacex.com embedded as encryption key material rather than as live infrastructure, a technique intended to complicate static detection.
Background & Context
Kaspersky assesses that earlier iterations of the Go-based implant underlying GoSerpent have been in use since 2021, with the current campaign representing a technical evolution rather than a new actor's debut. Attribution remains unconfirmed, but the security vendor has identified targeting patterns, technical capabilities, and operational overlaps with TetrisPhantom, an actor it first documented in October 2023 targeting Asia-Pacific government entities through compromise of secure, hardware-encrypted USB drives used to transfer data between air-gapped and networked systems.
The disclosure arrives alongside separate reporting on a distinct campaign, tracked by researchers as DoNot Team, targeting Bangladesh's military and defense establishments through spear-phishing emails carrying a malicious RTF document. Kaspersky and independent researchers have not linked the two operations, but their concurrent disclosure this month underscores a broader pattern: state-aligned or state-adjacent actors sustaining long-duration, document-focused espionage operations against South and Southeast Asian government targets on parallel tracks.
Analysis & Assessment
The operational discipline evident in GoSerpent, staging data locally for weeks before transfer, returning months later with upgraded tooling rather than immediately exfiltrating, and deliberately linking new payloads back to earlier-collected archives, is consistent with a well-resourced intelligence service or a contractor operating under similarly rigorous tradecraft standards, rather than a financially motivated criminal group. The use of in-memory payload injection and legitimate cloud infrastructure for command-and-control further suggests an actor calibrating its toolkit specifically to survive standard government network defenses over an extended dwell time.
The unresolved attribution to TetrisPhantom carries strategic weight beyond naming conventions. If confirmed, it would indicate a single actor sustaining APAC government-targeting operations across at least three years and two distinct delivery mechanisms, hardware-based exfiltration via secure USB in the earlier campaign, network-share-based exfiltration in the current one, demonstrating adaptability to defensive countermeasures rather than reliance on a single technique. Regional governments should treat the presence of any GoSerpent-associated artifact as an indicator of a mature, ongoing intrusion rather than an isolated infection, warranting full network threat-hunting rather than single-host remediation.