In late 2025, a cyber threat actor started a campaign that investigators later linked to the GoSerpent backdoor. The activity continued into 2026 and targeted government and diplomatic organizations across Southeast Asia. What stood out was not just the presence of malware, but the way multiple tools were coordinated over time to collect sensitive files, steal credentials, and exfiltrate data in a planned sequence.
Researchers observed the core intrusion moving through phases: first deploying the main Go-based remote access Trojan, then harvesting documents and system access data, and finally extending the operation with a newer proxy tool and a service-based loader for data theft. Below is a clear walk-through of how the attack chain worked, what components were involved, and why this level of tooling integration raises the risk for defenders.
Campaign timeline and overall approach
The campaign was first identified in February 2026, but evidence suggested it had been running since late 2025. During that time, the attackers used an encrypted, staged workflow. Instead of immediately sending stolen data out, they gathered information, stored it locally, and only exfiltrated later—reducing the chance of early detection and disrupting straightforward incident response.
By May 2026, the actor returned with an evolved toolkit. A new Go-based RAT and proxy tool, named Stowaway, expanded the operator’s ability to move through compromised networks. Alongside it, a stealthy loader component was used to retrieve the previously collected archives from the system and transmit them out using credentials stored in an encrypted configuration.
The GoSerpent backdoor: primary stage and key features
The GoSerpent backdoor served as the main “stage” of the intrusion. It is a Go-based remote access Trojan that appears to have been active since at least 2021, with more recent variants deployed in 2026. In the newest observed version, it accepts encrypted and base64-encoded command-line arguments that include a command-and-control address and a communication password.
To establish secure command handling, the malware decrypts its arguments using AES-CBC with a fixed initialization vector. It also derives cryptographic keys from predefined strings. For communications with command-and-control servers, the malware uses ChaCha20 encryption, with the SHA256 hash of the communication password acting as the encryption key.
GoSerpent also supports multiple command values that guide attacker behavior. Beyond remote control, it can establish SOCKS5 proxy servers. This lets the operators route traffic through infected machines, enabling access to other internal networks while complicating attribution and basic network monitoring.
Persistence, evasion, and deployment of follow-on tools
The malware was designed for persistence and stealth. Investigators reported that it used filenames that resemble legitimate system processes (for example, names such as lass.exe and updates.exe) to evade casual detection. It also used encrypted argument handling in newer variants, while older iterations were observed to accept parameters in plaintext from the command line.
Importantly, GoSerpent was not the only component. It acted as the delivery mechanism for additional tools used for data collection and credential theft. Those follow-on tools included a file collection service, credential dumping utilities, and local password hash extraction.
A simpler proxy variant: McMx
Alongside the newest GoSerpent variant, investigators found earlier or simpler components referred to as McMx. This tool is a basic Go-based proxy and remote access component that functions similarly but with fewer protections. In observed deployments, McMx read input parameters from text files in plaintext format rather than receiving encrypted command-line arguments.
Before running McMx, attackers manipulated batch files to generate configuration files. These configuration artifacts included remote host addresses, ports, and secret keys created via echo-style commands. Like its more advanced counterpart, McMx provided key capabilities for attacker movement and operational flexibility:
- SOCKS5 proxying
- Port forwarding
- File transfer
- Remote shell capabilities
While McMx may appear “less stealthy” than the latest GoSerpent variant, attackers still used it during recent activity—suggesting they kept multiple options depending on operational needs.
Collecting documents: ThumbcacheService
After GoSerpent was deployed, the attackers typically waited several days before using it to trigger the next stage. One reason for this delay was to collect sensitive files and store them for future exfiltration.
The file-collection functionality centered on ThumbcacheService, a malicious DLL installed as a Windows service. It used a simple XOR-based obfuscation (a single-byte key) to hide internal strings, then decrypted embedded content at runtime.
To store results, the service created a database file named thumbcache_605a.db under C:\Users\Public. The tool focused on documents matching specific extensions: .doc, .docx, .pdf, .xls, and .xlsx. This targeted approach indicates the actor’s intent to prioritize office files and common document formats rather than indiscriminately harvesting all data.
Collected files were then archived using 7-Zip and protected with a predefined password. The process also enforced a 20MB size limit for archives—likely to balance staging efficiency and reduce the footprint on disk. The service additionally monitored the $Recycle.Bin directory and looked for deleted files with the same extensions, expanding coverage to artifacts users attempted to remove.
Stealing access: credential dumping utilities
Collecting documents alone is rarely enough for successful exfiltration and persistence. In this campaign, attackers also sought credentials to enable later access to network drives and facilitate data transfer.
Through GoSerpent, the operator deployed credential dumping tools, including:
- Mimikatz to extract credential material from the LSASS process, including cached credentials and Kerberos tickets.
- QuarksDumpLocalHash to obtain local account password hashes by extracting from the SAM registry hive, enabling offline password cracking.
The stolen credentials were used later to support exfiltration of the files gathered earlier by ThumbcacheService.
May 2026 update: Stowaway and the new exfiltration loader
After the initial phase, the attackers allowed additional time for ThumbcacheService to continue collecting files without immediate exfiltration. During this window, credential dumping activities continued as well, ensuring the actor had both the data and the access to move it.
In May 2026, they returned with a newer main malware component for that round: Stowaway. Like GoSerpent, Stowaway functioned as a Go-based RAT and proxy tool, designed to be stealthier by drawing from open-source frameworks and adding customized behavior.
Chained proxying and encrypted communications
Stowaway supported multiple network-oriented capabilities, including SOCKS5 proxying, port forwarding, reverse tunneling, remote shell access, file transfer, and SSH-based tunneling. It could create chained proxy paths across several hosts, which helps attackers route traffic while reducing direct exposure from a single compromised endpoint.
For transport, investigators reported that communications used TCP, HTTP, or WebSocket channels protected with AES-256-GCM or TLS encryption. That matters because strong encryption can reduce what defenders can observe at the network layer.
TmcLoader/TmcPayload: staged exfiltration via a service
As the next step, Stowaway delivered two files to the victim machine: TmcLoader (with an embedded payload) and an encrypted configuration database file with a GUID-like name.
TmcLoader is a stealth-focused C++ loader registered as a Windows service. It embedded TmcPayload inside its .data section, decrypted the payload, and loaded it into memory within the svchost process to maintain persistence and reduce detection.
The loader used dynamic API resolution and obfuscated API names using a circular XOR approach combined with Base64 encoding. It also created a unique event to help prevent repeated infections on the same system.
After initialization, TmcPayload prepared the exfiltration path by constructing a location under C:\Users\Public\Libraries with an obfuscated filename tied to the encrypted configuration. It checked whether the configuration file existed and, if not, waited for a randomized delay before trying again.
The configuration file contained encrypted network share credentials and destination paths. Critically, it referenced the earlier output artifact created by ThumbcacheService, specifically the thumbcache_605a.db database that was archived and staged during the earlier phase.
In other words, the attack chain was integrated: the first component collected and staged data, and the later payload used a configuration-driven process to move that same collected artifact to attacker-controlled destinations.
Why this toolchain integration matters
A key takeaway from the investigation is how deliberately the components were connected. The campaign didn’t rely on a single “big” malware binary doing everything. Instead, it used a sequence where each tool set up the next stage’s inputs:
- GoSerpent delivered ThumbcacheService to collect and archive targeted documents into thumbcache_605a.db.
- GoSerpent also delivered credential dumping tools to obtain the system and local credentials needed for later movement.
- Stowaway delivered encrypted configuration data that included network share credentials and exfiltration destination paths.
- TmcLoader/TmcPayload read that configuration, then located the same thumbcache database created earlier for transfer.
This kind of orchestration points to operational planning aimed at long-term access and intelligence gathering, not just short-lived compromise.
Infrastructure and operational patterns
Operators used legitimate hosting providers for their command-and-control infrastructure, including Alibaba Cloud and UCLOUD HK. Using reputable infrastructure can increase operational security and make malicious traffic harder to distinguish from normal services.
Researchers also noted technical similarities between GoSerpent and Stowaway that suggest familiarity with proxy-based techniques. Both families used consistent methods for secret keys tied to domain names. For example, GoSerpent used domains such as www.microsoft.com and www.spacex.com as secret keys, while Stowaway used a domain resembling github.code, indicating a standardized methodology across tool generations.
Attribution signals and remaining uncertainty
Exact attribution for the GoSerpent backdoor campaign remained uncertain. Investigators discussed possible links to a threat actor named TetrisPhantom based on similarities in victim targeting, technical capabilities, and operational methods. However, they emphasized that more investigation is needed before confirming such a relationship.
Defensive value: what organizations can learn
The campaign underscores several practical security priorities for organizations in targeted regions. First, defenders should anticipate multi-stage activity: file collection may occur well before exfiltration begins. Second, credential dumping via LSASS and local hash extraction can directly enable later stages, so hardening authentication, limiting admin privileges, and monitoring for suspicious credential access remain important.
Finally, the presence of proxying and chained tunnels means that network egress controls alone may not catch everything. Visibility into service creation, unusual proxy behaviors, and unexpected database or archive creation under public directories can help detect stages of the chain earlier.
By understanding the tactics, techniques, and procedures used in this campaign, security teams can improve detection coverage and respond more effectively to similar threats as attackers continue to evolve their tooling.
Indicators of compromise (high level)
Researchers also listed file hashes associated with the observed malware components. These include hashes for GoSerpent, McMx, ThumbcacheService, Stowaway, and TmcLoader, alongside command-and-control IP addresses used by the campaign. Organizations can use these indicators as part of broader threat-hunting and incident response workflows.
Overall, the GoSerpent backdoor campaign demonstrates how sophisticated malware ecosystems can combine encryption, stealth services, credential theft, and staged exfiltration into a cohesive operation.
Source: https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/
