GoSerpent APT: Unattributed Go-Based Backdoor Spent 5+ Years Harvesting SEA Government, Police Biometric, and Diplomatic Data

Kaspersky GReAT disclosed on July 16–17 a previously undocumented espionage campaign active since at least 2021, using a Go-based RAT named GoSerpent to target government, law enforcement, and diplomatic entities across Southeast Asia — including police complaint management systems and biometric databases. After months of silent credential harvesting via ThumbcacheService, operators returned in May 2026 to deploy Stowaway (a SOCKS5/AES-256-GCM proxy tool) and TmcLoader for staged exfiltration through internal network shares using stolen legitimate credentials, making detection by standard network monitoring effectively blind. The threat actor remains unattributed; C2 infrastructure was concealed behind Alibaba Cloud and UCLOUD HK.

The threat actor remains unattributed; C2 infrastructure was concealed behind Alibaba Cloud and UCLOUD HK.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.