Threats Tagged 'quarksdumplocalhash'

Since late 2025, government and diplomatic entities in Southeast Asia have been targeted by sophisticated attacks involving GoSerpent, a Go-based remote access trojan (RAT) with proxy capabilities. The malware uses encrypted communications and deploys multiple tools for data collection and credential dumping. The campaign includes several stages, such as initial deployment of GoSerpent and ThumbcacheService for file collection, credential dumping using Mimikatz and QuarksDumpLocalHash, and later deployment of Stowaway RAT and TmcLoader/TmcPayload for stealthy data exfiltration via network shares. The attackers leverage cloud infrastructure and are possibly linked to the TetrisPhantom threat actor. No specific software versions are affected, and no patches are available as this is malware rather than a software vulnerability.