GoSerpent Silently Steals Government Files for Weeks Before Sending Them to Hackers

A sophisticated cyber espionage campaign targeting government and diplomatic organizations across Southeast Asia has used a Go-based remote access Trojan, dubbed GoSerpent, to collect sensitive documents for weeks before exfiltrating them via network shares.

Researchers first identified the activity in February 2026, although evidence indicates the operation began in late 2025.

The attackers deployed GoSerpent as the primary foothold, then used it to install file-collection and credential-dumping utilities.

In May 2026, they returned with an evolved toolset featuring the Stowaway RAT and a dedicated exfiltration chain named TmcLoader and TmcPayload.

The operation is notable for its patience and tight integration. Rather than immediately sending stolen data to command-and-control infrastructure, the threat actor first staged files locally, harvested credentials, and waited before transferring archives using access to network shared drives.

The malware subsequently protects C2 traffic with ChaCha20, deriving its encryption key from the SHA-256 hash of the supplied password.

The backdoor supports remote shell access, file uploads and downloads, port forwarding, listening services, and SOCKS5 proxy creation.

SOCKS5 functionality allows operators to route malicious traffic through compromised systems, concealing their infrastructure and potentially enabling lateral movement into connected networks.

GoSerpent also acts as a deployment framework for additional payloads. Observed files masqueraded as legitimate processes, including lass.exe and updates.exe, to reduce scrutiny.

Kaspersky said in a report shared with GBhackers, GoSerpent is a Go-based RAT with proxy capabilities that has likely been active since at least 2021. Earlier variants accepted command-line parameters in plaintext, while the latest versions use Base64-encoded, AES-CBC-encrypted arguments.

The attackers used the implant to deploy ThumbcacheService, Mimikatz, and QuarksDumpLocalHash.

GoSerpent Steals Government Files

ThumbcacheService is a malicious DLL registered as a Windows service. It searches systems for documents with .doc, .docx, .pdf, .xls, and .xlsx extensions, including relevant files deleted into the Windows $Recycle.Bin directory.

The malware saves the collected material in C:\Users\Public\thumbcache_605a.db, then archives it with 7-Zip using a predefined password and a 20 MB20\text{ MB}20 MB archive limit.

Meanwhile, Mimikatz targets LSASS memory for credentials, cached authentication material, and Kerberos tickets, while QuarksDumpLocalHash extracts local account password hashes from the Windows SAM database.

Those stolen credentials became central to the later exfiltration phase.

The attackers returned in May with Stowaway, a customized version of an open-source Go proxy and RAT framework.

Stowaway supports SOCKS5 proxying, reverse tunnels, remote shells, file transfer, SSH tunnels, and port forwarding across TCP, HTTP, and WebSocket channels. Its communications can use AES-256-GCM or TLS protections.

Through Stowaway, the operators delivered TmcLoader, a C++ service-based loader, and an encrypted configuration file named {BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db.

TmcLoader decrypts an embedded TmcPayload directly into svchost.exe memory, helping the malware evade traditional file-based defenses.

TmcPayload repeatedly checks for a configuration file under C:\Users\Public\Libraries\ and uses its encrypted contents to obtain network-share credentials, destination paths, and the target archive location.

Crucially, the payload explicitly references thumbcache_605a.db, linking the final transfer operation to the files silently collected months earlier.

The operators hosted C2 infrastructure on legitimate cloud platforms including Alibaba Cloud and UCLOUD HK.

Researchers also observed legitimate domains used as embedded secret-key material, including www.microsoft.com, www.spacex.com, and github.code.

Although attribution remains unconfirmed, technical overlap, victimology, and operational behavior suggest a possible connection to the suspected TetrisPhantom threat actor.

Government networks should monitor for suspicious services, the thumbcache_605a.db artifact, unusual access to network shares, credential-dumping activity, and unauthorized SOCKS5 or reverse-tunneling behavior.

Indicators of compromise

Malware Family	MD5 Hash
GoSerpent	EBFFD5A76AAA690BCDB922F82E0BACC5
GoSerpent	DC506FF7BB72735444FB3703A6BEE6D8
McMx	D6E86BF8A90E9B632ADD5FA495F97FBC
ThumbcacheService	CB6C4C70A3B171FA3404B8E1A3382116
ThumbcacheService	64E9D1950E42BC98486DFD9919463D1C
Stowaway	CBBB6D483737EA3566726E51752DFF40
Stowaway	7F223EE0716CE2AD56F55D3744419449
Stowaway	19F8BEFCB035F52BF70094E6B4F5779A
Stowaway	846EF7C1C7323849B2A778C5E4CDA162
TmcLoader	D08A059E8B815E3B891505BC8777FC28
TmcLoader	93A1569D5D5AB2C4761FEDF84F83709E

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide