Kaspersky Uncovers GoSerpent, a Go-Based Backdoor Spying on Southeast Asian Governments Since Late 2025

Overview

Kaspersky’s Global Research and Analysis Team has identified a previously undocumented backdoor called GoSerpent used in an espionage campaign against government and diplomatic entities in Southeast Asia. According to Securelist, the company’s threat-intelligence blog, researchers “discovered a set of malicious activities that had been ongoing since late 2025” when they identified the campaign in February 2026. The Hacker News similarly reports that Kaspersky “uncovered the activity in February 2026” after the malware had been “put to use in cyber attacks targeting entities in Southeast Asia since late 2025.”

What We Know

GoSerpent is built around a remote access Trojan written in the Go programming language. Securelist describes the activity as involving “a RAT module written in Go with proxy capabilities, which served as the main stage of the attack,” adding that “the attack targeted government and diplomatic entities in Southeast Asia and showed a level of sophistication that caught our attention.” GBHackers likewise identifies “a Go-based remote access Trojan, dubbed GoSerpent,” used in a cyber-espionage operation against the same category of targets.

The malware’s core capabilities center on covert access and credential theft. It can establish SOCKS5 proxies to route traffic through compromised machines, dump memory from the LSASS process to pull credential material, transfer files, open remote shells, and forward or listen on network ports, according to Securelist’s technical breakdown. The attackers also rely on the credential-dumping tool Mimikatz, a detail corroborated by both Securelist and The Hacker News.

Alongside the GoSerpent backdoor itself, the campaign deploys supporting tools. One, which Securelist calls ThumbcacheService, is “a malicious DLL deployed as a Windows service that functions as a sophisticated file collection mechanism.” GBHackers describes the same component as a malicious DLL that searches for office documents and “saves the collected material in C:\Users\Public\thumbcache_605a.db” — a file path and name that matches Securelist’s own description of a database file created at “C:\Users\Public\” to store collected sensitive files. Securelist adds that the tool obfuscates strings with “XOR encryption with a single-byte key of 0x13,” and that gathered files are “archived using 7-Zip and protected with a predefined password,” with archives capped at a “20MB size limit.” GBHackers reports the targeted material includes “documents with .doc, .docx, .pdf, .xls, and .xlsx extensions.” A second component, TmcLoader, is described by Securelist as “a stealthy C++ loader module registered as a Windows service,” while GBHackers adds that it “decrypts an embedded TmcPayload directly into svchost.exe memory.” Command-and-control traffic uses ChaCha20 encryption, and command-line arguments sent to the malware are encrypted with AES-CBC mode, per Securelist.

Kaspersky says the operators returned to compromised networks with new tools in May 2026. Securelist reports that “in May 2026, they came back with an evolved set of malicious tools,” and The Hacker News reports the same return, noting the new toolset included “Stowaway, a proxy and remote access tool.” Securelist describes Stowaway as “a proxy and remote access tool compiled from an open-source framework,” and GBHackers adds that it “supports SOCKS5 proxying, reverse tunnels, remote shells, file transfer, SSH tunnels, and port forwarding.”

Securelist also notes that it “found earlier versions of the GoSerpent backdoor used since 2021 against victims in Southeast Asia,” indicating the malware family itself predates the government-and-diplomatic campaign now under investigation.

On attribution, Kaspersky is cautious. Securelist states that “while the exact attribution of the GoSerpent campaign remains uncertain, there are indications of a potential link to the TetrisPhantom threat actor.” The Hacker News reports that “the campaign shares targeting, technical capabilities, and operational overlaps with TetrisPhantom,” while cautioning that “definitive attribution remains cloudy at best.” GBHackers frames it the same way, writing that “attribution remains unconfirmed” but that “technical overlap, victimology, and operational behavior suggest a possible connection to the suspected TetrisPhantom threat actor.” TetrisPhantom is not a new name: The Hacker News reported in October 2023 that Kaspersky had identified the actor covertly harvesting “sensitive data from APAC government entities by exploiting a particular type of secure USB drive,” describing an intrusion set that “has not been linked to any known threat actor or group” but whose sophistication “points to a nation-state crew.”

What We Don’t Know

Kaspersky has not named specific victim countries, agencies, or organizations, referring throughout its analysis only to “Southeast Asia” as a region and to “government and diplomatic entities” as a category. The number of affected organizations has not been disclosed. The link to TetrisPhantom remains explicitly unconfirmed by Kaspersky’s own account, and neither Securelist nor the corroborating reporting identifies a nation-state sponsor by name.

Analysis

Securelist’s own assessment frames the operation as a case study in patient, tool-driven espionage rather than a smash-and-grab intrusion: “The GoSerpent campaign represents a sophisticated and evolving threat to government and diplomatic entities in Southeast Asia,” the researchers wrote, adding that the operators’ “use of customized tools” demonstrates “a high degree of technical expertise and operational planning.” The return of the same operators in May 2026 with a new, more capable proxy and tunneling tool in Stowaway suggests the campaign is still active rather than a single completed intrusion, and the possible — if unconfirmed — link to a group that Kaspersky first tied to APAC government targeting in 2023 points to a pattern of persistent, multi-year interest in the region’s government networks rather than an isolated incident.