GoSerpent Backdoor Targets Southeast Asian Governments With Credential Theft and Stealthy Data Exfiltration

A sophisticated cyber-espionage campaign targeting government and diplomatic organizations in Southeast Asia has deployed the GoSerpent backdoor to steal credentials, collect documents, and quietly exfiltrate data through network shares.

Researchers observed the activity beginning in late 202520252025, with a renewed wave in May 202620262026.

The operation combines custom malware, open-source remote-access tooling, credential dumpers, and stealthy loaders in a long-term intelligence-gathering chain.

GoSerpent Backdoor Campaign

GoSerpent is a Go-based remote access Trojan (RAT) active since at least 202120212021. Recent versions accept encrypted, Base64-encoded command-line parameters containing command-and-control (C2) details.

It uses AES-CBC to decrypt the configuration and ChaCha20 to protect C2 communications.

The malware can check in with its operators, launch remote shells, transfer files, open listening ports, and connect to remote systems.

It can also create SOCKS5 proxies, allowing attackers to route traffic through compromised government machines and mask the origin of their activity.

Attackers used deceptive filenames such as lass.exe and updates.exe to blend in with legitimate Windows processes.

They also deployed a simpler related tool named McMx, which retains similar proxying, port-forwarding, file-transfer, and shell capabilities but stores its C2 parameters in plaintext configuration files.

After gaining access, the operators waited several days before downloading additional tools. This delay likely reduced suspicion and helped establish longer-term access to affected environments.

The first stage focused on collecting documents and obtaining credentials. A malicious DLL called ThumbcacheService was installed as a Windows service and searched systems for files with .doc, .docx, .pdf, .xls, and .xlsx extensions.

The tool stored collected content in C:\Users\Public\thumbcache_605a.db. It also monitored the Windows $Recycle.Bin directory, enabling it to capture deleted documents of interest.

Files were archived with 7-Zip, password-protected, and limited to 20 MB20\text{ MB}20 MB per archive.

GoSerpent also delivered Mimikatz and QuarksDumpLocalHash. Mimikatz can extract credential material from the LSASS process, including cached credentials and Kerberos tickets.

At the same time, QuarksDumpLocalHash retrieves password hashes from the local SAM registry hive. The stolen credentials were later used to access network shares and steal data, securelist said.

In May 202620262026, the threat actors introduced Stowaway, a customized proxy and remote-access tool based on an open-source framework.

Stowaway supports SOCKS5 proxying, reverse tunnels, port forwarding, remote shells, file transfers, and SSH tunneling. It can communicate using TCP, HTTP, or WebSocket channels protected with AES-256-GCM or TLS.

Stowaway delivered TmcLoader, a C++ service-based loader containing an encrypted payload called TmcPayload.

TmcLoader decrypts the payload and loads it into the memory of svchost.exe, helping the attackers evade file-based security tools.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs