GoSerpent Malware: New Espionage Campaign Targets Southeast Asian Officials

A sophisticated, long-running cyber espionage operation has been identified targeting government, diplomatic, and public sector entities across Southeast Asia. The campaign relies on a previously undocumented backdoor known as GoSerpent malware to maintain persistent access to sensitive systems, allowing threat actors to monitor internal networks, harvest credentials, and exfiltrate confidential files over extended periods.

Understanding the GoSerpent Malware Infrastructure

Researchers have tracked the evolution of this campaign back to 2021, though the current operational cycle intensified in late 2025 and continued throughout 2026. The GoSerpent malware functions primarily as a remote access trojan (RAT), which establishes a communication link between the victim’s device and the attacker’s infrastructure. By utilizing legitimate cloud services—specifically Alibaba Cloud and UCLOUD HK—the perpetrators effectively disguise their command-and-control traffic as standard business operations.

This reliance on reputable cloud infrastructure is a deliberate strategy to evade detection by automated security systems that might otherwise block connections to suspicious, unknown domains. By blending in with legitimate traffic, the attackers can maintain a footprint on targeted machines for months at a time, quietly collecting data without triggering typical endpoint security alerts.

Technical Tactics and Data Exfiltration

The campaign’s methodology demonstrates a high level of operational security and patience. Once the backdoor is successfully installed, it does not immediately move to steal data. Instead, it waits for several days before deploying secondary tools. This “dwell time” strategy allows the malware to integrate into the system environment, making it harder for IT teams to distinguish the malicious processes from routine administrative tasks.

The attackers employ several specialized tools in tandem with the GoSerpent backdoor to broaden their reach:

• Stowaway: Used for post-exploitation lateral movement within the network.
• TmcLoader: A secondary component used to fetch additional malicious payloads once the connection is established.
• Credential Harvesters: Tools designed to scrape login information for lateral movement or future access.

Beyond traditional file theft, the malware is capable of monitoring deleted documents. This indicates that the operators are specifically searching for “trail-covering” attempts or deleted sensitive drafts that might still reside in system sectors, ensuring they gather as much intelligence as possible from targeted government systems.

Implications for Data Privacy and Security

For organizations, this campaign underscores the danger of “living-off-the-cloud” tactics. When attackers hide behind trusted cloud services, traditional IP-based blacklisting fails to provide sufficient data protection. Security teams must shift their focus toward anomaly detection and behavioral analysis to spot the subtle signs of a RAT infection.

Strategic Recommendations for Defenders

Defenders should assume that sophisticated actors are targeting their perimeter with tools specifically designed to evade standard detection. To mitigate the risk of campaigns like the one utilizing GoSerpent, organizations should implement the following:

1. Monitor Egress Traffic: Even when connections look legitimate, analyze the volume and frequency of traffic toward cloud hosting providers.
2. Strengthen Identity Security: Given the focus on credential harvesting, enforce multi-factor authentication (MFA) and consider hardware-based security keys to prevent stolen credentials from being useful to attackers.
3. Endpoint Behavioral Analytics: Implement tools that monitor process-level behavior rather than just file signatures, particularly looking for unauthorized tools like Stowaway.
4. Enhanced Document Protection: Use encryption for highly sensitive internal documents to ensure that even if they are exfiltrated, they remain unreadable to unauthorized parties.

The Path Forward

While the exact identity of the threat actor behind the GoSerpent malware remains unconfirmed, researchers have noted significant technical similarities to the TetrisPhantom group. This actor is known for its previous use of trojanized USB management software to compromise government systems in the Asia-Pacific region. As these campaigns evolve, the reliance on sophisticated backdoors and hidden infrastructure will likely continue. Organizations operating in sensitive sectors must prioritize a Zero Trust architecture, assuming that internal perimeters may already be compromised and that data security must be enforced at the device and file levels.