GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration

In February 2026, Securelist identified a persistent threat campaign targeting government and diplomatic entities primarily in Southeast Asia, spearheaded by a sophisticated actor potentially linked to TetrisPhantom. The campaign began in late 2025 and has continued to evolve, demonstrating a high level of technical expertise and operational planning.

What happened

The core of the campaign revolves around a Go-based remote access Trojan, dubbed GoSerpent, which has been active since at least 2021, with the most recent variant deployed in 2026. GoSerpent receives encrypted and base64-encoded command-line arguments containing the C2 server address and communication password, which are decrypted using AES-CBC mode with a fixed IV (31323334353637383930616263646566). The backdoor connects to command-and-control servers using ChaCha20 encryption for communications, with the SHA256 hash of the communication password serving as the encryption key. GoSerpent supports multiple C2 commands, including establishing SOCKS5 proxy servers to route traffic through compromised hosts. The malware exhibits strong persistence mechanisms and uses filenames that mimic legitimate system processes such as lass.exe and updates.exe to evade detection.

Initially, the attack involved deployment of GoSerpent and subsequent deployment of additional malicious tools. The primary goal was to collect sensitive files and store them for future exfiltration, achieved through a data collecting tool called ThumbcacheService. ThumbcacheService is a malicious DLL deployed as a Windows service that functions as a sophisticated file collection mechanism within the GoSerpent ecosystem. The malware employs XOR encryption with a single-byte key of 0x13 for string obfuscation. It decrypts embedded strings and creates a database file named thumbcache_605a.db in the C:\Users\Public\ directory to store collected sensitive files. The targeted files include .doc, .docx, .pdf, .xls, and .xlsx.

Following initial deployment, the threat actor allowed a few weeks for ThumbcacheService to silently collect sensitive files without exfiltrating them. Simultaneously, credential dumping tools continued to steal credentials. In May 2026, the threat actor came back with a new set of tools, including Stowaway, a proxy and remote access tool compiled from an open-source framework with customized functions to make the infection more stealthy. Stowaway features both network admin and agent capabilities, enabling attackers to establish chained proxy paths across multiple hosts. The tool uses TCP, HTTP, or WebSocket channels with protection using AES-256-GCM or TLS encryption.

Stowaway delivers two files to the victim machine: TmcLoader with an embedded payload and {BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db, an encrypted configuration file. TmcLoader is a stealthy C++ loader module registered as a Windows service. The malware embeds an encrypted payload dubbed TmcPayload within its .data section, which is decrypted and loaded into the memory space of the svchost process to maintain persistence and avoid detection. TmcLoader employs dynamic API resolution through a circular XOR encryption where each byte is XORed with the value of the subsequent byte, combined with Base64 encoding for string obfuscation to hide API names.

After TmcLoader extracts and decrypts the embedded TmcPayload, the payload component is responsible for exfiltrating sensitive data from the victim’s machine. TmcPayload generates a file path from an obfuscated string: C:\Users\Public\Libraries\{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db and then checks for the existence of this configuration file. If the file doesn’t exist, it delays execution for a random time before rechecking. The configuration file contains encrypted network share credentials and destination paths for data exfiltration, specifically referencing the thumbcache_605a.db file created by ThumbcacheService as the file to be exfiltrated, demonstrating the integrated nature of the attack chain.

Technical details

GoSerpent backdoor: Receives encrypted and base64-encoded command-line arguments containing the C2 server address and communication password. Uses ChaCha20 encryption for communications with the C2 server.

McMx: A simpler Go-based proxy and remote access tool, resembling older versions of GoSerpent.

ThumbcacheService: A malicious DLL deployed as a Windows service that collects sensitive files using XOR encryption.

Stowaway: A proxy and remote access tool compiled from an open-source framework.

TmcLoader/TmcPayload: A stealthy C++ loader module and its embedded payload, respectively.

Impact The campaign targets government and diplomatic entities in Southeast Asia, highlighting a significant risk to national security and sensitive information. The integration of various tools – data collection, credential dumping, and exfiltration – demonstrates a sophisticated and long-term approach to intelligence gathering.

What to do

• Implement robust endpoint detection and response (EDR) solutions with behavioral analysis capabilities.
• Regularly update antivirus and anti-malware software.
• Enforce strong password policies and multi-factor authentication.
• Segment the network to limit the potential impact of a breach.
• Monitor network traffic for suspicious activity, including unusual outbound connections to C2 servers.
• Conduct regular vulnerability assessments and penetration testing.
• Implement network monitoring and logging to detect anomalous behavior.
• Educate employees about phishing and social engineering tactics.

Why it matters The GoSerpent campaign underscores the evolving threat landscape and the increasing sophistication of cyberattacks targeting critical infrastructure and government agencies. The campaign’s reliance on legitimate hosting providers for C2 infrastructure makes detection more challenging, emphasizing the need for proactive security measures and continuous monitoring.