Cybersecurity researchers at Kaspersky have uncovered a previously undocumented malware called GoSerpent, which has been targeting government and diplomatic entities in Southeast Asia since late 2025 for espionage and long-term intelligence gathering. The malware connects to a command-and-control server to deploy secondary payloads capable of credential dumping, file collection, and data exfiltration, while also supporting SOCKS5 proxying to mask attackers' true IP addresses. The campaign shares similarities with the known threat actor TetrisPhantom, though definitive attribution remains uncertain, and a separate but related espionage operation by DoNot Team was also disclosed, targeting Bangladesh's military using spear-phishing emails.
