GoSerpent Campaign Targeting Southeast Asian Entities

In February 2026, a persistent campaign targeting government and diplomatic organizations in Southeast Asia was identified. The attack utilizes GoSerpent, a Go-based remote access Trojan (RAT) that has evolved since 2021 to include encrypted command-line arguments and enhanced proxy capabilities. The threat actor, potentially linked to TetrisPhantom, follows a phased operational methodology involving multi-stage tool deployment for long-term intelligence gathering.

The attack chain begins with the GoSerpent backdoor, which facilitates the deployment of data collection tools like ThumbcacheService and credential dumpers such as Mimikatz. After a period of silent data gathering, attackers transition to a second stage using the Stowaway proxy framework to deliver TmcLoader. This final stage exfiltrates archived sensitive files via network shares using stolen credentials, demonstrating a high degree of technical orchestration and operational security through the use of legitimate cloud infrastructure and encrypted communications.