GoSerpent Backdoor: Five-Year Espionage Campaign Targeting Southeast Asian Governments and Biometric Systems

Key Findings

• GoSerpent backdoor has targeted Southeast Asian government and diplomatic networks since at least 2021
• Campaign demonstrates extreme patience, with operators waiting weeks between infection and data exfiltration to evade log retention systems
• Stolen credentials enable final data theft to appear as legitimate internal file-share access, bypassing standard network monitoring
• Toolchain includes GoSerpent RAT, ThumbcacheService collector, credential dumpers, Stowaway RAT, and TmcLoader/TmcPayload exfiltration modules
• Victims include government agencies, police departments, biometric databases, and diplomatic entities
• Attribution remains uncertain but Kaspersky notes possible link to TetrisPhantom actor
• Infrastructure hosted on Alibaba Cloud and UCLOUD HK to blend with legitimate traffic

Background

Kaspersky's Global Research and Analysis Team disclosed the campaign on July 16, 2026, following a five-year investigation into what appears to be one of the most patient cyber espionage operations documented in recent years. The campaign has successfully compromised Southeast Asian government networks with minimal public detection, targeting sensitive materials including police complaint files, biometric records, and diplomatic communications.

Initial Compromise and Persistence Strategy

GoSerpent functions as the first-stage backdoor, delivered through an undisclosed vector. The malware is a Go-based RAT that reads encrypted, base64-encoded command-line arguments containing the command-and-control address and communication password. What distinguishes this operation is its deliberate restraint. Rather than immediately deploying exfiltration tools, operators allow the backdoor to sit quietly for several days, a tactic designed to outlast automated security sweeps and evade correlation of events across security logs.

Two-Phase Infection Chain

The operation unfolds across two distinct phases. In phase one, GoSerpent establishes and maintains a quiet presence. After several days, the backdoor pulls secondary tools into the network. ThumbcacheService, a malicious Windows service, begins collecting files by targeting Office documents and PDFs, compressing them with 7-Zip under a password, and even monitoring the Recycle Bin for deleted materials. Simultaneously, credential dumpers extract secrets from LSASS memory and the SAM registry hive.

Operators returned in May 2026 with updated tooling. A new Go-based RAT named Stowaway replaced GoSerpent as the primary tool, adding reverse tunneling and SSH-based tunneling capabilities. Stowaway then delivered the exfiltration payload: TmcLoader and its embedded TmcPayload component. TmcLoader operates as a Windows service that decrypts its payload directly into svchost memory, maintaining invisibility to process-monitoring tools.

Command-and-Control and Exfiltration Infrastructure

GoSerpent encrypts C2 traffic using ChaCha20, the same cipher found in TLS 1.3 and WireGuard. The encrypted connections are difficult to distinguish from legitimate HTTPS at the network level. The backdoor can also establish SOCKS5 proxies through compromised systems, routing operator traffic through victims to obscure the attacker's true IP address. The group even reuses legitimate domain names as secret keys for additional cover.

The exfiltration design shows tight operational integration. TmcPayload reads a configuration file containing network-share credentials and destinations, then transfers the exact database that ThumbcacheService assembled. The stolen credentials from phase one make this file-share transfer appear as authorized internal activity, allowing it to bypass network monitoring tools that flag external connections but treat authenticated internal traffic as benign.

Attribution and Operational Links

Attribution remains officially uncertain. Kaspersky cannot definitively link the campaign to a named threat actor or individuals. However, the team identifies a possible connection to TetrisPhantom based on overlapping victims, shared malware components, and similar operational patterns. The assessment stops short of confirmation, indicating ongoing investigation.

Detection and Defensive Measures

Defenders can begin hunting using several indicators. Check the Public user folder for the staging database and anomalous password-protected archives. Audit newly created Windows services that load DLLs mimicking legitimate system components. Monitor svchost processes for outbound connections to the published C2 addresses. Because this campaign operates in deliberate stages separated by weeks, organizations should extend log retention periods beyond standard policies and establish detection systems capable of correlating events across extended timeframes.

Kaspersky published file hashes and 11 C2 IP addresses, providing immediate starting points for defensive hunting operations.

Sources

• https://securityonline.info/goserpent-backdoor/
• https://www.techtimes.com/articles/320796/20260717/goserpent-backdoor-looted-police-biometric-data-across-southeast-asia-five-years.htm
• https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html
• https://securelist.com/goserpent-backdoor-in-southeast-asia/120687