GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
GoSerpent backdoor targets SE Asian governments with multi-stage attacks using RATs and credential dumping tools
Researchers discovered a sophisticated two-phase attack campaign using the GoSerpent backdoor, targeting government and diplomatic entities in Southeast Asia since late 2025. The malware, a Go-based RAT with encryption and SOCKS5 proxy capabilities, deploys secondary tools including Stowaway RAT, ThumbcacheService for data collection, and credential dumping utilities for sensitive file exfiltration. The threat actor evolved their toolset by May 2026 with enhanced stealth capabilities while maintaining backward compatibility with earlier, simpler variants dating back to 2021.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe GoSerpent campaign demonstrates how advanced persistent threat (APT) actors can maintain long-term, undetected footholds in sensitive government and diplomatic networks by continuously evolving their toolsets. The attackers leveraged a Go-based RAT with encryption and SOCKS5 proxying to blend malicious traffic with legitimate activity, making detection extremely difficult. Secondary payloads like ThumbcacheService and credential dumpers enabled quiet, sustained data exfiltration over extended periods. The campaign's evolution since 2021 highlights that insufficient network monitoring and weak lateral movement controls allowed the threat to persist unnoticed for years. This matters because government and diplomatic data exfiltration carries severe national security implications that extend far beyond typical data breach scenarios.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GoSerpent
- malware — Stowaway RAT
- malware — ThumbcacheService
- malware — TmcLoader/TmcPayload
- malware — McMx RAT