--- title: GoSerpent backdoor attacks in Southeast Asia | daily.dev description: Kaspersky researchers detail a sophisticated two-phase cyberattack campaign targeting government and diplomatic entities in Southeast Asia, active since late... canonical: https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GoSerpent backdoor attacks in Southeast Asia | daily.dev og:description: Kaspersky researchers detail a sophisticated two-phase cyberattack campaign targeting government and diplomatic entities in Southeast Asia, active since late... og:url: https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei og:image: https://api.daily.dev/og/posts/S7oKvGHEi.png og:image:alt: GoSerpent backdoor attacks in Southeast Asia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GoSerpent backdoor attacks in Southeast Asia **[Securelist](https://daily.dev/sources/securelist)** 路 9 min read 路 13 upvotes 路 1 comments ## Summary Kaspersky researchers detail a sophisticated two-phase cyberattack campaign targeting government and diplomatic entities in Southeast Asia, active since late 2025. The primary tool is GoSerpent, a Go-based backdoor with SOCKS5 proxy, file transfer, and remote shell capabilities, using AES-CBC and ChaCha20 encryption for C2 communications. In the initial phase, GoSerpent deploys ThumbcacheService (a DLL that silently collects and archives Office/PDF documents), Mimikatz, and QuarksDumpLocalHash for credential theft. In May 2026, attackers returned with Stowaway (an open-source-based proxy RAT) and TmcLoader/TmcPayload, a C++ loader that injects into svchost to exfiltrate the previously collected data via network shares using stolen credentials. The toolchain is tightly integrated: ThumbcacheService stores files in a specific database, and TmcPayload is hardcoded to exfiltrate that exact file. Infrastructure relies on Alibaba Cloud and UCLOUD HK. Attribution tentatively points to TetrisPhantom. IoCs including file hashes and C2 IPs are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GoSerpent backdoor and what can it do? GoSerpent is a Go-based remote access Trojan active since at least 2021, used against government and diplomatic entities in Southeast Asia. It receives encrypted, base64-encoded command-line arguments containing C2 address and password, decrypted via AES-CBC with a fixed IV, then communicates using ChaCha20 encryption. It supports commands for shell access, file upload/download, SOCKS5 proxying, port forwarding, and deploying tools like Mimikatz and ThumbcacheService. _Security teams tracking backdoor tactics like GoSerpent's can follow evolving threat research on daily.dev._ ### How does the ThumbcacheService malware collect and stage stolen files? ThumbcacheService is a malicious DLL run as a Windows service that uses single-byte XOR (0x13) string obfuscation and stores collected documents (.doc, .docx, .pdf, .xls, .xlsx) in a database file named thumbcache_605a.db under C:\Users\Public\. Collected files are archived with 7-Zip under a hardcoded password with a 20MB size limit, and it also monitors the Recycle Bin for deleted files matching those extensions. _Defenders reverse-engineering file-collection malware like this can track similar IOCs on daily.dev._ ### What is the Stowaway RAT and how does it fit into a data exfiltration chain? Stowaway is a proxy and remote access tool built from an open-source framework, offering SOCKS5 proxying, port forwarding, reverse tunneling, remote shell, file transfer, and SSH tunneling over TCP, HTTP, or WebSocket with AES-256-GCM or TLS encryption. Attackers use it to deliver TmcLoader and an encrypted configuration file, which together decrypt network share credentials and exfiltrate the thumbcache_605a.db file collected earlier by ThumbcacheService. _Analysts mapping multi-stage exfiltration toolchains can dig into cases like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@devmount** 路 1 upvotes > Kudos to whoever had the idea for this thumbnail 馃槏 ## Similar posts on daily.dev - [Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia](https://daily.dev/posts/suspected-china-based-espionage-operation-against-military-targets-in-southeast-asia-gqascxcy9) 路 Unit 42 路 0 upvotes 路 0 comments - [Cloud Atlas group acquires new tools](https://daily.dev/posts/cloud-atlas-group-acquires-new-tools-dshnjta3i) 路 Securelist 路 0 upvotes 路 0 comments - [SideWinder Espionage Campaign Expands Across Southeast Asia](https://daily.dev/posts/sidewinder-espionage-campaign-expands-across-southeast-asia-bdpa1s0qo) 路 Dark Reading 路 0 upvotes 路 0 comments - [Windows version of SprySOCKS Linux malware used to attack govt orgs](https://daily.dev/posts/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs-iyygrdkhw) 路 BleepingComputer 路 1 upvotes 路 0 comments - [Silver Dragon Targets Organizations in Southeast Asia and Europe](https://daily.dev/posts/silver-dragon-targets-organizations-in-southeast-asia-and-europe-svwipmebu) 路 Check Point Research 路 0 upvotes 路 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GoSerpent backdoor attacks in Southeast Asia","url":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei"},"datePublished":"2026-07-16T12:01:20.176Z","dateModified":"2026-09-14T06:13:44.605Z","description":"Kaspersky researchers detail a sophisticated two-phase cyberattack campaign targeting government and diplomatic entities in Southeast Asia, active since late...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebea07df20e5da0c663d0f138f60fe6d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebea07df20e5da0c663d0f138f60fe6d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"golang,malware","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"GoSerpent backdoor attacks in Southeast Asia"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei","comment":[{"@type":"Comment","text":"Kudos to whoever had the idea for this thumbnail 馃槏","datePublished":"2026-07-17T05:06:26.198Z","url":"https://daily.dev/posts/S7oKvGHEi#c-eWEixEK03","author":{"@type":"Person","name":"Andreas","url":"https://daily.dev/devmount","image":"https://media.daily.dev/image/upload/s--0yHQgkD3--/f_auto/v1730121566/avatars/avatar_wkPuMtV83z5WseTrVc5QU"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei#faq","mainEntity":[{"@type":"Question","name":"What is the GoSerpent backdoor and what can it do?","acceptedAnswer":{"@type":"Answer","text":"GoSerpent is a Go-based remote access Trojan active since at least 2021, used against government and diplomatic entities in Southeast Asia. It receives encrypted, base64-encoded command-line arguments containing C2 address and password, decrypted via AES-CBC with a fixed IV, then communicates using ChaCha20 encryption. It supports commands for shell access, file upload/download, SOCKS5 proxying, port forwarding, and deploying tools like Mimikatz and ThumbcacheService. Security teams tracking backdoor tactics like GoSerpent's can follow evolving threat research on daily.dev."}},{"@type":"Question","name":"How does the ThumbcacheService malware collect and stage stolen files?","acceptedAnswer":{"@type":"Answer","text":"ThumbcacheService is a malicious DLL run as a Windows service that uses single-byte XOR (0x13) string obfuscation and stores collected documents (.doc, .docx, .pdf, .xls, .xlsx) in a database file named thumbcache_605a.db under C:\\Users\\Public\\. Collected files are archived with 7-Zip under a hardcoded password with a 20MB size limit, and it also monitors the Recycle Bin for deleted files matching those extensions. Defenders reverse-engineering file-collection malware like this can track similar IOCs on daily.dev."}},{"@type":"Question","name":"What is the Stowaway RAT and how does it fit into a data exfiltration chain?","acceptedAnswer":{"@type":"Answer","text":"Stowaway is a proxy and remote access tool built from an open-source framework, offering SOCKS5 proxying, port forwarding, reverse tunneling, remote shell, file transfer, and SSH tunneling over TCP, HTTP, or WebSocket with AES-256-GCM or TLS encryption. Attackers use it to deliver TmcLoader and an encrypted configuration file, which together decrypt network share credentials and exfiltrate the thumbcache_605a.db file collected earlier by ThumbcacheService. Analysts mapping multi-stage exfiltration toolchains can dig into cases like this on daily.dev."}}]} ```