[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEz3kPbJebSG0QwZ3gnc7iPLWbkPCLw0NE8jsj9Ka5cs":3},{"article":4,"iocs":42,"watch_terms":64,"solutions":65,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"180d11e7-eb68-4ef4-bc55-6360554a0948","New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage","new-goserpent-malware-targets-southeast-asian-governments-and-diplomats-for-espi-cf5dd3","Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering. Russian cybersecurity company Kaspersky, which uncovered the activity in February 2026, said it was aimed at government and diplomatic entities in","Kaspersky discovered GoSerpent, a previously undocumented malware targeting Southeast Asian government and diplomatic entities since late 2025. The backdoor deploys secondary payloads for credential dumping and sensitive data collection, with evolved variants including Stowaway RAT and ThumbcacheService appearing in May 2026. The campaign demonstrates sophisticated multi-stage attack chains designed for persistent access and covert intelligence gathering.","GoSerpent malware targets Southeast Asian governments and diplomats for long-term espionage.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnew-goserpent-malware-targets-southeast.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgzr3TN2Kp4PBOBbzsR0RkNNu6_pMaYw05DjwQIegOdSeuDW5SAivGHOy3Qznjx5KJUTuiPRqAJsTDpM1O94X_FuG2sXAjD84rgPHwGxp2tFuP53Dm8pd-9bInejjZY7wx1jLBWu_EikCQ4HACf6J5Ycc3-kiTVE6-83MtCDCsL71o-7sFema5tOIV4IcJm\u002Fs1600\u002FGoSerpent-malware.jpg","2026-07-17T08:46:45+00:00","2026-07-17T12:00:28.332363+00:00",9,[17,20,23],{"name":18,"type":19},"GoSerpent Campaign","campaign",{"name":21,"type":22},"Kaspersky","vendor",{"name":24,"type":25},"SOCKS5 proxy","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":28,"name":29,"slug":30},null,"Nation-state","nation-state",[32,37],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43,46,49,52,55,58,61],{"type":36,"value":44,"context":45},"GoSerpent","Primary Go-based backdoor and RAT targeting Southeast Asian government entities since late 2025",{"type":36,"value":47,"context":48},"Stowaway","Evolved proxy and remote access tool deployed May 2026 with SOCKS5 proxying and SSH tunneling",{"type":36,"value":50,"context":51},"ThumbcacheService","DLL for sophisticated file collection and sensitive data staging",{"type":36,"value":53,"context":54},"McMx RAT","Lightweight Go-based proxy tool with SOCKS5 and file transfer capabilities",{"type":36,"value":56,"context":57},"TmcLoader","C++ loader module containing encrypted TmcPayload for data exfiltration",{"type":36,"value":59,"context":60},"Mimikatz","Credential dumping tool for extracting LSASS memory",{"type":36,"value":62,"context":63},"QuarksDumpLocalHash","Tool for extracting local account password hashes from SAM registry",[21],{"controls":66,"vendors":144},[67,96,122],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":118,"product_name":119,"url":120,"description":121},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":123,"name":124,"problem":125,"products":126},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":164},"goserpent-backdoor-targets-se-asian-governments-in-sophisticated-espionage-campaign","GoSerpent Backdoor Targets SE Asian Governments in Sophisticated Espionage Campaign","The GoSerpent campaign illustrates how advanced threat actors exploit insufficient endpoint visibility and weak access controls to establish persistent footholds within high-value government and diplomatic networks. By deploying multi-stage payloads — including credential dumping tools and remote access trojans like Stowaway RAT — attackers can silently harvest sensitive intelligence over extended periods without triggering detection. The evolution of variants across time suggests a well-resourced adversary actively refining tradecraft in response to defensive measures. This matters because compromised diplomatic credentials and state secrets can have severe geopolitical consequences far beyond typical data breaches.",[150,151,152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review","MITRE ATT&CK T1003 – OS Credential Dumping","MITRE ATT&CK T1059 – Command and Scripting Interpreter","MITRE ATT&CK T1071 – Application Layer Protocol (C2)","ITIL – Security Incident Management","NIST Cybersecurity Framework – Detect (DE.CM-1)",{}]