The new GoSerpent RAT targeted government and diplomatic entities in Southeast Asia. The campaign underscores the threat actor’s emphasis on maintaining long-term access and conducting intelligence collection.
In July 2026, researchers from the Kaspersky Global Research and Analysis Team (GReAT) team identified a new campaign, dubbed GoSerpent, representing a sophisticated and adaptive threat focused on the collection and exfiltration of sensitive data. According to the researchers, the operation relies on a set of customized tools, including the GoSerpent backdoor, Stowaway, and TmcLoader, reflecting a high level of technical capability and operational planning.
A central component of the campaign is the GoSerpent backdoor, a sophisticated Go-based Remote Access Trojan (RAT) that has reportedly been active since at least 2021, with the latest known variant deployed in 2026. The malware incorporates strong persistence mechanisms and uses filenames that imitate legitimate system processes to reduce the likelihood of detection.
“What stands out about GoSerpent is the deliberate dwell time. Usually, attackers want to move quickly once they get a foothold, but this group drops the initial backdoor and waits. They let the dust settle for weeks before deploying their secondary exfiltration tools like TmcLoader. That kind of patience is a calculated move designed to outlast standard log retention policies and automated security sweeps, making it incredibly difficult for defenders to connect the initial infection to the eventual data theft,” — says Noushin Shabab, Lead Security Researcher in Kaspersky GReAT.
The company’s researchers suspect a link between the GoSerpent campaign and the TetrisPhantom threat actor based on shared victimology, technical capabilities, and operational methods. While there are similarities, further investigation is ongoing to definitively attribute the campaign.
To stay safe, Kaspersky GReAT experts recommend organizations:
-
Remain highly vigilant against the deployment of GoSerpent IoCs and other tools presented in the report.
-
Apply cybersecurity solutions that enable government agencies worldwide to regain full control over their data, ensure compliance with local regulations, and build resilient, sovereign digital infrastructures. Such options are provided by Kaspersky solutions like:
-
Kaspersky Next which enables unified real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR.
-
Kaspersky Security for Mail Server which safeguards email communications through anti-phishing, attachment sandboxing, and business email compromise protection.
-
Kaspersky Digital Footprint Intelligence which monitors the external attack surface and dark web for exposed credentials, offering government teams an outside-in view of their risk landscape.
-
Kaspersky Compromise Assessment, Managed Detection and Response and Incident Response which help protect against evasive cyberattacks, investigate incidents and provide additional expertise if companies lack cybersecurity workers.
