GoSerpent Malware Launches Targeted Espionage Campaign Against Southeast Asian Governments and Diplomats

Key Takeaways

• Researchers uncovered GoSerpent, a Go‑based malware used since late 2025 for long‑term espionage against Southeast Asian government and diplomatic targets.
• GoSerpent establishes encrypted C2 communication, can launch a SOCKS5 proxy, and deploys additional tools for credential dumping and file collection.
• In May 2026 the threat actor refreshed the arsenal with Stowaway RAT, TmcLoader/TmcPayload, and other utilities to harvest and exfiltrate data collected over months.
• The malware’s command set includes heartbeat, port management, remote shell, file transfer, proxying, and forwarding capabilities.
• Supporting tools such as ThumbcacheService, Mimikatz, and QuarksDumpLocalHash enable sophisticated data gathering and credential theft.
• Technical and operational similarities link the campaign to the previously identified TetrisPhantom APT, suggesting a common or related actor.
• A separate disclosure details DoNot Team’s spear‑phishing attack on Bangladesh’s military, using an RTF document with remote template injection to deliver a VBA macro, shellcode, and a persistent DLL implant.
• The DoNot Team chain showcases modular payload delivery, geofencing, and AES‑key‑based attribution markers consistent with earlier operations.
• Together, these findings highlight the evolving, multi‑stage nature of cyber‑espionage threats in the APAC region and the importance of monitoring for living‑off‑the‑land binaries, abnormal proxy traffic, and credential‑dumping activity.

Overview of GoSerpent Discovery
In February 2026, Kaspersky researchers identified a previously undocumented malware family dubbed GoSerpent that has been active since late 2025, primarily targeting government and diplomatic entities across Southeast Asia. The implant is written in the Go programming language and functions as a backdoor designed for long‑term presence, enabling attackers to maintain persistent access while gathering intelligence. Unlike ransomware or disruptive malware, GoSerpent’s goal is stealthy data collection and preparation for later exfiltration, making it a classic cyber‑espionage tool aimed at high‑value targets in the APAC region.

Technical Mechanics of GoSerpent
GoSerpent receives its configuration via encrypted, Base64‑encoded command‑line arguments that contain the command‑and‑control (C2) server address and a communication password. Once the arguments are decrypted, the malware establishes an encrypted TLS‑like channel to the C2 server, using the SHA256 hash of the password as the symmetric encryption key. This design protects the traffic from casual inspection and ensures that only parties possessing the correct password can communicate with the infected host. The backdoor remains dormant until it receives a command, at which point it executes the requested action and returns any output to the C2 channel.

Core Capabilities and Command Set
The supported command list empowers operators with a versatile toolkit: (1) alive – notifies the server of an active infection; (2) listen – opens a listening socket for relayed traffic; (3) close – shuts down a previously opened listener; (4) connect – initiates an outbound TCP connection to a remote system; (5) shell – spawns an interactive command prompt on the victim; (6) upload – transfers files or directories from the host to the server; (7) download – pulls files from the C2 server onto the infected machine; (8) proxy – starts a SOCKS5 proxy on the host; and (9) forward – forwards traffic between a local port and a remote node. These functions allow the attacker to pivot laterally, exfiltrate data, and conceal their true origin through compromised hosts.

Secondary Payloads Deployed by GoSerpent
Beyond its native capabilities, GoSerpent acts as a delivery platform for additional malicious tools. Kaspersky observed the deployment of ThumbcacheService, a DLL that indexes and collects user files—particularly thumbnails and documents—based on predefined criteria, facilitating bulk data gathering. For credential theft, the implant launches Mimikatz to read the Local Security Authority Subsystem Service (LSASS) memory and extract plaintext passwords, Kerberos tickets, and other authentication material. Complementarily, QuarksDumpLocalHash reads the SAM registry hive to dump local account password hashes, enabling offline cracking or pass‑the‑hash attacks. Together, these tools provide a comprehensive suite for harvesting both file‑based intelligence and authentication secrets.

Evolution in May 2026 – Stowaway, TmcLoader, and TmcPayload
Months after the initial intrusion, the threat actors returned to compromised environments in May 2026 with an updated toolset. They introduced Stowaway, a more feature‑rich Go‑based RAT that replicates GoSerpent’s core functions while adding reverse tunneling, SSH‑based tunneling, and enhanced file‑transfer capabilities. Accompanying Stowaway was TmcLoader, a C++ loader containing an encrypted payload named TmcPayload. Once executed, TmcPayload exfiltrates the previously collected sensitive data—harvested by ThumbcacheService and credential‑dumping modules—through the established C2 channels or via the SOCKS5 proxies deployed earlier. This staged approach demonstrates a deliberate separation of duties: long‑term surveillance, data aggregation, and finally, stealthy exfiltration.

Operational Sophistication and Link to TetrisPhantom
Kaspersky analysts noted that the tactical flow—from initial infiltration via GoSerpent, through data collection with ThumbcacheService and credential tools, to the eventual exfiltration using TmcLoader/TmcPayload—mirrors the methodology of the previously tracked TetrisPhantom APT, first documented in October 2023. Both campaigns share targeting of government entities in the APAC region, employ multi‑stage malware chains, and utilize proxies and tunneling to obscure attacker infrastructure. While definitive attribution remains uncertain, the overlapping techniques, code similarities, and use of Go‑based implants suggest a possible relationship or shared toolset between the two threat actors.

DoNot Team Spear‑Phishing Campaign Against Bangladesh Military
In a parallel disclosure, Cyderes Howler Cell detailed a targeted espionage operation by the DoNot Team aimed at Bangladesh’s military and defence establishments. The attack begins with a spear‑phishing email containing a Rich Text Format (RTF) document that leverages remote template injection to fetch a VBA macro. Crucially, the macro delivery is gated by server‑side geofencing: the malicious payload is served only to recipients whose IP addresses resolve to the target region, while benign templates are sent to outsiders, reducing the chance of early detection.

DoNot Team Implant Mechanics – VBA Macro, Shellcode, and DLL Persistence
When the VBA macro executes, it invokes callback‑based Windows API abuse to inject architecture‑aware shellcode into a legitimate process. This shellcode is retrieved in multiple XOR‑encoded stages, each hosted under innocuous‑looking file extensions on the same C2 domain. The final stage drops a second‑stage DLL named ejtest.dll, which registers itself as a scheduled task masquerading as OneDrive telemetry to achieve persistence. The DLL provides a modular download capability, allowing the operators to pull further payloads—such as additional RATs, proxy tools, or data‑collection modules—directly from the C2 server over HTTPS. The use of scheduled tasks and legitimate‑looking network traffic helps the implant blend with normal host activity.

Attribution Evidence and Broader Implications for APAC Cyber‑Espionage
Attribution to DoNot Team rests on several technical markers: matching AES key material used for payload encryption, identical C2 URI paths observed in earlier DoNot Team operations, and the reuse of VBA‑based shellcode injection techniques. These consistencies, combined with the geofencing tactic, form a strong fingerprint linking the current campaign to the group’s historical activity. Taken together, the GoSerpent and DoNot Team incidents illustrate a broader trend in the APAC cyber‑espionage landscape: adversaries are employing living‑off‑the‑land binaries, multi‑stage malware chains, proxy‑based traffic obfuscation, and region‑restricted delivery mechanisms to evade defenses. Organizations should prioritize monitoring for anomalous outbound connections, unauthorized SOCKS5 proxy creation, credential‑dumping indicators (e.g., LSASS access), and unusual scheduled‑task registrations, while employing network segmentation and strict email attachment policies to reduce the attack surface.