New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage

Kaspersky reported a long-running cyber-espionage campaign targeting Southeast Asian government and diplomatic entities using a Go-based backdoor dubbed **GoSerpent** (active since 2021) that accepts encrypted/Base64 parameters, connects to C2 over an encrypted channel, and can deploy secondary tools for credential dumping and staged exfiltration (ThumbcacheService, Mimikatz, QuarksDumpLocalHash); operators returned in May 2026 with evolved implants (Stowaway, TmcLoader/TmcPayload), and the activity shows operational overlaps with known groups such as TetrisPhantom and DoNot Team.