{"id":1861,"date":"2026-07-17T23:28:11","date_gmt":"2026-07-17T23:28:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1861"},"modified":"2026-07-17T23:28:11","modified_gmt":"2026-07-17T23:28:11","slug":"new-goserpent-malware-targets-southeast-asian-governments-and-diplomats-for-espionage","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1861","title":{"rendered":"New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 17, 2026<\/span><\/span>Cyber Espionage \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent<\/strong> that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering.<\/p>\n

Russian cybersecurity company Kaspersky, which uncovered the activity in February 2026, said it was aimed at government and diplomatic entities in the region. GoSerpent is designed to contact an external server and deploy secondary payloads on sensitive data collection and credential dumping on the system.<\/p>\n

\u00abMonitoring the activities of this threat actor revealed that in May 2026 they came back with an evolved set of malicious tools: new Stowaway RAT and proxy tool which resembled the initial malware as well as an additional stealthy tool to exfiltrate sensitive data collected for the previous few months through network share,\u00bb security researcher Noushin Shabab said<\/a>.<\/p>\n

The end goal of these efforts is to harvest sensitive files and stage them for subsequent exfiltration using a data collecting tool dubbed ThumbcacheService. The attacks have also employed credential dumping tools via GoSerpent to capture system credentials need to facilitate data exfiltration through network shared drives.<\/p>\n

Earlier iterations of the Go-based implant and remote access trojan (RAT) have been put to use since 2021 against victims in Southeast Asia, with recent variants deployed as recently as this year.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The malware functions by receiving encrypted and Base64-encoded command-line arguments containing the command-and-control (C2) address and communication password. Once decrypted, the backdoor connects to the C2 server over an encrypted connection, where the SHA256 hash of the communication password serves as the encryption key.<\/p>\n

<\/p>\n

The list of supported commands is listed below –<\/p>\n