New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage
Summary: Kaspersky discovered a previously undocumented malware called GoSerpent, used since late 2025 against government and diplomatic entities in Southeast Asia and found by the vendor in February 2026. The Go-based backdoor receives encrypted, Base64-encoded command-line arguments carrying its command-and-control address and communication password, connects over an encrypted channel keyed to the SHA256 hash of that password, and deploys tools including ThumbcacheService for file collection, Mimikatz for credential dumping, and QuarksDumpLocalHash for local password hash extraction.
Bottom line: Kaspersky says the actor returned in May 2026 with a new Stowaway RAT and proxy tool to exfiltrate months of collected data through network shares, and notes targeting and operational overlaps with TetrisPhantom, which it documented in October 2023 exploiting hardware-encrypted USB drives against APAC government entities.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026