malware espionage Southeast Asia APT DoNot Team

GoSerpent Malware Has Been Quietly Raiding Southeast Asian Governments for Months

19 July 2026

Cybersecurity researchers at Kaspersky have uncovered a previously undocumented malware called GoSerpent, which has been targeting government and diplomatic entities in Southeast Asia since late 2025 for espionage and long-term intelligence gathering. The malware connects to a command-and-control server to deploy secondary payloads capable of credential dumping, file collection, and data exfiltration, while also supporting SOCKS5 proxying to mask attackers' true IP addresses. The campaign shares similarities with the known threat actor TetrisPhantom, though definitive attribution remains uncertain, and a separate but related espionage operation by DoNot Team was also disclosed, targeting Bangladesh's military using spear-phishing emails.

Kaspersky researchers have pulled back the curtain on a previously unknown malware family called GoSerpent, which has been quietly burrowing into government and diplomatic networks across Southeast Asia since late 2025. The firm spotted the activity in February 2026, and what they found suggests a threat actor more interested in patient, methodical intelligence collection than smash-and-grab tactics.

GoSerpent is a Go-based backdoor that phones home to a command-and-control server and pulls down secondary payloads once it has a foothold. It receives encrypted, Base64-encoded arguments containing the C2 address and a communication password, decrypts them at runtime, and establishes an encrypted channel using the SHA256 hash of that password as the key. Tidy, if not exactly novel.

The command set covers the usual bases: alerting the C2 of an active infection, spawning a remote shell, uploading and downloading files, opening and closing listening ports, connecting to remote servers, and running a SOCKS5 proxy to route traffic through compromised hosts. That last capability is worth flagging. By turning victim machines into proxy nodes, the attackers can pivot through internal networks while keeping their actual infrastructure off the radar.

Go-based variants of this implant have apparently been in circulation since 2021, targeting victims across the same region. This campaign is not a fresh operation so much as an established one that just got a significant toolkit upgrade.

The operational picture that emerges is methodical. For months, the attackers used a tool called ThumbcacheService, a DLL that handles file collection in the background, staging sensitive documents while making minimal noise. Standard credential dumping tools also made an appearance: Mimikatz for pulling credentials from LSASS memory, and QuarksDumpLocalHash for extracting local account password hashes from the SAM registry. The aim was to gather enough access to move laterally via network shares and eventually get the collected data out.

Then in May 2026, the same threat actors returned to compromised environments with a fresh set of tools. The lightweight McMx RAT, essentially a stripped-down GoSerpent with proxy and remote shell functionality, was joined by Stowaway, a more capable proxy tool supporting SOCKS5, port forwarding, reverse tunneling, and SSH-based tunneling. They also brought in a C++ loader called TmcLoader, carrying an encrypted payload named TmcPayload designed specifically to exfiltrate the sensitive data that ThumbcacheService had been quietly collecting for months.

Kaspersky's Noushin Shabab described this as a two-phase operation: silent collection followed by coordinated exfiltration. The handoff from ThumbcacheService to TmcLoader and TmcPayload suggests careful planning rather than opportunistic improvisation.

Attribution remains murky. Kaspersky notes overlaps in targeting, tooling, and operational style with TetrisPhantom, a threat actor the firm first documented in October 2023. TetrisPhantom previously targeted APAC government entities by compromising hardware-encrypted USB drives to move malware between air-gapped or isolated systems. Whether GoSerpent is TetrisPhantom under a new banner or simply a group sharing tools and tradecraft is not yet clear.

Separately, researchers at Cyderes Howler Cell have detailed a different espionage operation, this one attributed to DoNot Team and aimed at Bangladesh's military and defence sector. The attack chain starts with a spear-phishing email carrying a malicious RTF document. The RTF uses remote template injection to pull down a VBA macro from the attacker's infrastructure, with server-side geofencing in place to ensure the payload only reaches victims inside the target region. Anyone outside it gets a clean template.

Once the macro runs, it executes architecture-aware shellcode through callback-based API abuse, pulling additional XOR-encoded stages from the same C2 domain using file extensions designed to look innocuous. The end result is a DLL implant that establishes scheduled-task persistence under the guise of OneDrive telemetry, profiles the host, and beacons back over HTTPS. A second-stage DLL with modular download capabilities handles follow-on payloads from there.

DoNot Team attribution rests on matching C2 URI patterns, shared AES key material, consistent VBA injection tradecraft, and the geofenced delivery mechanism that the group has used before.

Two separate espionage operations, different targets, different toolkits, but the same underlying patience. Both groups are clearly comfortable playing a long game.

READ NEXT

ToddyCat's Umbrij Malware Quietly Hijacks Gmail via OAuth Abuse ACR Stealer Is Raiding Enterprise Networks and All It Needs Is for Someone to Press Enter Brazilian Gov Websites Hijacked to Deliver Malware in Active Banking Campaign