The GoSerpent backdoor campaign targets government and diplomatic entities in Southeast Asia using a multi-stage attack chain. Active since 2021, newer GoSerpent variants use AES-CBC and ChaCha20 encryption for command and control communications. Initial infection involves deploying GoSerpent and ThumbcacheService to collect sensitive files, followed by credential dumping using tools like Mimikatz and QuarksDumpLocalHash. In May 2026, the attackers deployed the Stowaway RAT and TmcLoader/TmcPayload to exfiltrate data covertly via network shares. The campaign demonstrates sophisticated operational planning and infrastructure use, including Alibaba Cloud and UCLOUD HK. The threat actor is possibly TetrisPhantom. Indicators include multiple malware hashes and IP addresses. No CVE or software vulnerability is associated with this campaign.

The campaign enables attackers to collect sensitive files, dump credentials, and exfiltrate data stealthily from targeted government and diplomatic networks in Southeast Asia. The use of multiple tools and encrypted communications complicates detection and mitigation efforts. Compromise of credentials and sensitive data can lead to significant operational and intelligence losses for affected entities.

This is a malware campaign rather than a software vulnerability; therefore, no patches or official fixes exist. Organizations should focus on detection and response measures tailored to the provided indicators of compromise, including monitoring for the listed malware hashes and IP addresses. Restricting the use of network shares and deploying endpoint detection solutions capable of identifying credential dumping and proxy RAT activity are recommended. Review the referenced vendor advisory for detailed detection and response guidance. Patch status is not applicable.