New GoSerpent Malware Targets Southeast Asian Governments in Espionage Campaign

Cybersecurity researchers have uncovered a previously unknown malware called GoSerpent that has been used in cyber espionage attacks against government and diplomatic organizations across Southeast Asia since late 2025. The campaign is designed to maintain long-term access to compromised systems while collecting sensitive information.

Discovered by Kaspersky in February 2026, the malware communicates with remote command-and-control (C2) servers and deploys additional malicious tools to collect confidential files, steal credentials, and prepare stolen data for exfiltration.

Researchers found that the attackers returned in May 2026 with an upgraded toolkit, introducing a new version of the Stowaway remote access tool along with additional malware capable of quietly extracting sensitive information that had been collected over several months.

The primary objective of the campaign is to gather confidential documents, store them on compromised systems, and later transfer them out of victim networks. To achieve this, the attackers use ThumbcacheService for file collection and credential dumping tools such as Mimikatz and QuarksDumpLocalHash to obtain passwords and account hashes needed to move through networks and access shared drives.

GoSerpent is a Go-based backdoor that receives encrypted command-line arguments containing the C2 server address and authentication password. After decrypting the information, it establishes an encrypted connection with the attacker-controlled server using the SHA-256 hash of the communication password as the encryption key.

The malware supports a wide range of remote operations, including:

• Reporting active infections to the C2 server
• Opening and closing listening ports
• Connecting to remote systems
• Launching remote command shells
• Uploading and downloading files
• Creating SOCKS5 proxy servers
• Forwarding traffic between compromised systems

By creating SOCKS5 proxy servers, GoSerpent allows attackers to route malicious traffic through infected devices, helping conceal their real location while providing access to additional networks.

During the attacks, researchers observed several supporting tools, including:

• McMx RAT, a lightweight Go-based remote access and proxy tool with file transfer, remote shell, port forwarding, and SOCKS5 capabilities.
• ThumbcacheService, a DLL used to collect sensitive files from infected machines.
• Mimikatz, which extracts credentials from the Windows Local Security Authority Subsystem Service (LSASS).
• QuarksDumpLocalHash, which retrieves local account password hashes from the Windows Security Account Manager (SAM).

Months after the initial compromise, the attackers deployed another set of tools to expand their capabilities. These included Stowaway, which supports reverse tunneling, SSH tunneling, remote shell access, file transfers, and proxy functions, as well as TmcLoader, a C++ loader that decrypts and launches TmcPayload, a malware component responsible for exfiltrating previously collected sensitive data.

Researchers said the coordinated use of multiple malware families demonstrates careful operational planning, with dedicated tools assigned to credential theft, file collection, persistence, and final data exfiltration.

Although the campaign has not been definitively attributed, Kaspersky said it shares significant similarities with TetrisPhantom, an advanced threat actor previously identified for targeting government organizations across the Asia-Pacific region. The group was earlier linked to attacks that abused hardware-encrypted secure USB drives to steal and transfer sensitive information between isolated computer systems.

DoNot Team Targets Bangladesh’s Defence Sector

In a separate investigation, researchers at Cyderes Howler Cell uncovered a cyber espionage campaign conducted by the DoNot Team, targeting Bangladesh’s military and defence organizations.

The attackers used spear-phishing emails containing malicious RTF documents that exploited remote template injection to download VBA macros. The malware delivery was restricted through geofencing, ensuring only victims located within the intended target region received the malicious payload.

Once executed, the macro deployed architecture-specific shellcode through callback-based API techniques before downloading several XOR-encrypted payload stages from the same command-and-control server.

The attack ultimately installed a second-stage DLL named ejtest.dll, which established persistence through a scheduled task disguised as OneDrive telemetry, profiled the infected system, communicated with a C2 server over HTTPS, and supported the download of additional malware modules.

Researchers attributed the operation to the DoNot Team based on shared command-and-control infrastructure, matching AES encryption keys, similar VBA shellcode injection techniques, and the use of geofenced malware delivery methods.