[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBmt_za2gvV-Ht6ob7xVkKFcGoan_UoEzQmmOCjIjCRk":3},{"article":4,"iocs":44,"watch_terms":60,"solutions":61,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"ce3ed7ce-7857-4500-8ce1-ed5feea1d80e","GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration","goserpent-a-persistent-threat-evolves-with-sophisticated-data-collection-and-exf-554ace","Two-phase attacks with the GoSerpent backdoor, Stowaway RAT, ThumbcacheService and other tools aim to steal data from government entities in Southeast Asia.","Researchers discovered a sophisticated two-phase attack campaign using the GoSerpent backdoor, targeting government and diplomatic entities in Southeast Asia since late 2025. The malware, a Go-based RAT with encryption and SOCKS5 proxy capabilities, deploys secondary tools including Stowaway RAT, ThumbcacheService for data collection, and credential dumping utilities for sensitive file exfiltration. The threat actor evolved their toolset by May 2026 with enhanced stealth capabilities while maintaining backward compatibility with earlier, simpler variants dating back to 2021.","GoSerpent backdoor targets SE Asian governments with multi-stage attacks using RATs and credential dumping tools","https:\u002F\u002Fsecurelist.com\u002Fgoserpent-backdoor-in-southeast-asia\u002F120687\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F16074922\u002Fgoserpent-featured-image-scaled.jpg","2026-07-16T12:00:27+00:00","2026-07-16T14:00:06.956592+00:00",9,[17,20],{"name":18,"type":19},"GoSerpent Campaign","campaign",{"name":21,"type":22},"ChaCha20 encryption","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,48,51,54,57],{"type":27,"value":46,"context":47},"GoSerpent","Go-based backdoor\u002FRAT active since 2021, targeting SE Asian government entities",{"type":27,"value":49,"context":50},"Stowaway RAT","Secondary RAT deployed in May 2026 evolution of the campaign",{"type":27,"value":52,"context":53},"ThumbcacheService","Data collection tool deployed in initial phase for sensitive file gathering",{"type":27,"value":55,"context":56},"TmcLoader\u002FTmcPayload","Stealthy exfiltration tool for network share data theft",{"type":27,"value":58,"context":59},"McMx RAT","RAT module deployed alongside GoSerpent in multi-stage attacks",[],{"controls":62,"vendors":150},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":93,"name":94,"problem":95,"products":96},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":122,"name":123,"problem":124,"products":125},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":174},"goserpent-backdoor-targets-government-entities-with-stealthy-multi-stage-attacks","GoSerpent Backdoor Targets Government Entities with Stealthy Multi-Stage Attacks","The GoSerpent campaign demonstrates how advanced persistent threat (APT) actors can maintain long-term, undetected footholds in sensitive government and diplomatic networks by continuously evolving their toolsets. The attackers leveraged a Go-based RAT with encryption and SOCKS5 proxying to blend malicious traffic with legitimate activity, making detection extremely difficult. Secondary payloads like ThumbcacheService and credential dumpers enabled quiet, sustained data exfiltration over extended periods. The campaign's evolution since 2021 highlights that insufficient network monitoring and weak lateral movement controls allowed the threat to persist unnoticed for years. This matters because government and diplomatic data exfiltration carries severe national security implications that extend far beyond typical data breach scenarios.",[162,163,164,165,166,167,168,169,170,171,172,173],"NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 10 (Malware Defenses)","CIS Control 3 (Data Protection)","MITRE ATT&CK T1090.001 (Proxy: Internal Proxy)","MITRE ATT&CK T1003 (OS Credential Dumping)","MITRE ATT&CK T1041 (Exfiltration Over C2 Channel)","GDPR Article 32 (Security of Processing)","ISO\u002FIEC 27001 A.12.6 (Technical Vulnerability Management)",{}]