GoSerpent campaign used coordinated malware chain to steal government files

A previously undocumented malware campaign targeting government and diplomatic organizations in Southeast Asia used a succession of remote access, credential theft and data exfiltration tools designed to remain inside compromised networks for months before removing the information it had collected.

Kaspersky said it discovered the activity in February, although some of the attacks had been underway since late 2025.

Researchers found earlier versions of the principal backdoor, which they named GoSerpent, dating to 2021. The company has not conclusively identified the operator or disclosed the affected countries and organizations.

GoSerpent is a remote access Trojan written in the Go programming language. The more recent version is launched with an encrypted, Base64-encoded command line argument containing the address of its command-and-control server and a password used for communications.

The malware decrypts that information using AES-CBC encryption and then protects its exchanges with the remote server using ChaCha20 encryption.

Once connected, GoSerpent gives the operator broad control over the infected computer. It can open a command shell, upload or download files, connect to additional systems, listen on network ports, and forward traffic between compromised machines.

It can also turn the infected computer into a SOCKS5 proxy, allowing attackers to reach other parts of the victim’s network while obscuring the source of their activity.

Kaspersky found the malware using names resembling legitimate system files, including lass.exe and updates.exe.

GoSerpent was also used as a delivery mechanism. After establishing access, the attackers waited several days before installing ThumbcacheService, a malicious Windows service that searched for Word, Excel, and PDF files.

It stored copies in a database under the public users directory, compressed the material into password protected archives and imposed a 20-megabyte limit on individual archive files.

It also monitored the Windows Recycle Bin for deleted documents that matched the targeted file types.

The operators separately deployed Mimikatz to obtain credential material from Windows memory and QuarksDumpLocalHash to extract local account password hashes from the system registry.

According to Kaspersky, those credentials were not simply another category of stolen information. They were later used to move the collected files through network shares.

The operation then entered a second stage. After allowing ThumbcacheService to gather documents for several weeks, the attackers returned in May with Stowaway, a customized remote access and proxy tool capable of creating chained connections through multiple machines.

Stowaway supports SOCKS5 proxies, port forwarding, reverse tunnels, remote shells, file transfers and encrypted communications over TCP, HTTP, and WebSocket connections.

Stowaway delivered a loader called TmcLoader and an encrypted configuration file. TmcLoader installed itself as a Windows service, decrypted its payload and loaded it into the memory of the legitimate Windows svchost process, helping conceal the malware and maintain access.

The payload then read network share credentials and destination paths from the configuration file and transferred the database previously assembled by ThumbcacheService.

The significance of the campaign lies less in any single malware component than in how the tools were coordinated. One component established remote access, another collected documents, credential dumping utilities obtained the access needed for later movement, and a final payload removed the accumulated material.

Kaspersky said similarities in targeting and techniques suggest a possible connection to the group it tracks as TetrisPhantom but emphasized that the attribution remains uncertain.

Article Topics

access management  |  Kaspersky Lab  |  malware  |  Southeast Asia