Home

GoSerpent

Go-based RAT · Cyber-espionage · Government and diplomatic targets · Southeast Asia · Active since 2021 ·

Overview

GoSerpent is a Go-based remote access trojan first publicly documented in July 2026, identified in a cyber-espionage campaign targeting government and diplomatic entities in Southeast Asia. Security researchers who uncovered the activity in February 2026 found that attacks had been ongoing since late 2025, with earlier variants of the backdoor traced as far back as 2021. The campaign demonstrates a patient, multi-stage approach built entirely around long-term access and intelligence collection.

GoSerpent is the primary foothold tool, but the campaign is better understood as a coordinated toolkit. In Phase 1, GoSerpent deploys ThumbcacheService, a malicious Windows service that silently archives sensitive documents and monitors the Recycle Bin, alongside credential-dumping utilities. No data leaves the environment during this phase; the operator waits weeks while the collection accumulates. In May 2026, Phase 2 began: the operator returned with Stowaway, a customized open-source Go-based RAT, and deployed TmcLoader and TmcPayload, a two-stage exfiltration chain that uses the previously stolen credentials to transfer the archived file database through internal network shares, generating no external connections and no unusual authentication events.

The deliberate integration between the two phases distinguishes this campaign from commodity malware. ThumbcacheService writes its output to a specific file, thumbcache_605a.db. The TmcPayload configuration file, delivered weeks later by Stowaway, references that exact filename and the network share path to receive it. The tool chain was designed to work together, not assembled opportunistically.

Attribution remains uncertain. The victim profile and technical approach show similarities to TetrisPhantom, an APT group first documented in 2023 for targeting APAC government entities by compromising hardware-encrypted USB drives. That connection is assessed as probable but unconfirmed.

Why this matters for defenders: GoSerpent's most dangerous property is patience. Both the credential theft and the file collection run silently for an extended period before exfiltration begins. By the time the data moves, the theft has already happened. Detection must focus on the pre-exfiltration behaviors: a service with a plausible name writing an unusual database, a LSASS dumper running in an enterprise that does not have a legitimate use for one, and a process injected into svchost that accesses a specific file path and authenticates to a network share with credentials belonging to a different user.

Verify before relying on this: the exact initial delivery mechanism for the 2025-2026 campaign has not been publicly detailed. Attribution to TetrisPhantom is assessed as probable, not confirmed. Treat infrastructure indicators as time-limited.

Operational attack chain · GoSerpent two-phase espionage campaign

  1. GoSerpent deployed

    Go-based RAT with encrypted C2 args; masquerades as lass.exe or updates.exe.

  2. McMx supplementary access

    Simpler Go-based variant; configured via batch-generated plaintext config files.

  3. Phase 1: ThumbcacheService

    Malicious DLL service archives .doc/.docx/.pdf/.xls/.xlsx files and Recycle Bin into thumbcache_605a.db. Waits weeks.

    T1005T1560.001

  4. Credential dumping

    Mimikatz (LSASS) + QuarksDumpLocalHash (SAM hive) harvest domain and local hashes for later use.

    T1003.001T1003.002

  5. Phase 2: Stowaway RAT

    Custom Go RAT over AES-256-GCM/TLS, TCP/HTTP/WebSocket; multi-hop SOCKS5. Delivers Phase 2 payload.

    T1090.003

  6. TmcLoader injects TmcPayload

    C++ service loader decrypts TmcPayload and injects into svchost memory; reads encrypted config for share credentials.

    T1055T1543.003

  7. Exfiltration via network share

    TmcPayload transfers thumbcache_605a.db using stolen credentials over internal SMB shares. No external connection; indistinguishable from authorized file copy.

    T1039T1021.002

The deliberate gap between Phase 1 (collect) and Phase 2 (exfiltrate) is the campaign's defining operational choice. Files accumulate for weeks inside the environment before anything moves. By the time data leaves, its theft has already happened. Detection must cover both phases independently.

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

GoSerpent campaigns concentrate in Credential Access, Collection, Defense Evasion, and Command and Control, with Exfiltration deliberately routed through internal network shares rather than external connections. The campaign does not involve destructive impact; the objective is intelligence collection sustained over months.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev2Initial Access1Execution3Persistence3Priv. Esc0Defense Evasion4Credential Access3Discovery2Lateral2Collection4C24Exfiltration3Impact0
Technique detailKey techniques · GoSerpent campaign (2025-2026)
TacticTechniquesWhat GoSerpent doesDefender telemetry
Resource Development
Virtual Private Server T1583.003Domains T1583.001
C2 infrastructure uses legitimate cloud hosting providers (Alibaba Cloud, UCLOUD HK) to blend with normal enterprise traffic to hosted services. GoSerpent uses legitimate domain names as embedded secret keys (www.microsoft.com, www.spacex.com); Stowaway uses github.code, indicating a consistent methodology across tooling generations.C2 connections to Alibaba Cloud and UCLOUD HK IP ranges that are not associated with any business service; embedded domain strings in Go binaries extracted during static analysis.
Initial Access
Trusted Relationship T1199
The exact initial delivery mechanism for the 2025-2026 campaign has not been publicly documented. GoSerpent requires correct encrypted command-line arguments to operate, indicating operator-controlled deployment rather than self-spreading. The probable TetrisPhantom connection suggests prior use of trusted-channel access through hardware-encrypted USB drives; whether that vector was used in this campaign is unconfirmed.First-seen execution of a Go-compiled binary with command-line arguments containing long base64-encoded strings; new processes masquerading as system names (lass.exe, updates.exe) in user-writable directories.
Execution
Service Execution T1569.002Windows Command Shell T1059.003PowerShell T1059.001
ThumbcacheService and TmcLoader execute as registered Windows services. McMx is deployed by batch files using echo commands to write configuration files containing C2 parameters before executing the binary with those parameters. GoSerpent's remote shell command (Ss5 / Hello) can open interactive command access on the compromised host.New service installation events (Event ID 7045) for ThumbcacheService and TmcLoader; cmd.exe with echo commands writing configuration files; process creation of Go binaries with base64 command-line arguments.
Persistence
Windows Service T1543.003Match Legitimate Name T1036.005Registry Run Keys T1547.001
ThumbcacheService and TmcLoader both register as Windows services, surviving reboots. GoSerpent masquerades as legitimate system process names (lass.exe mimics lsass.exe; updates.exe mimics Windows Update processes) to evade visual inspection of running processes and process trees. The plausible naming is deliberate across all tools in the campaign.Service creation for ThumbcacheService or TmcLoader (Event ID 7045); lass.exe or updates.exe executing from non-system directories; services registered with legitimate-sounding names that do not appear in the approved software baseline.
Defense Evasion
Obfuscated Files T1027Process Injection T1055Masquerading T1036Deobfuscate/Decode T1140
ThumbcacheService uses XOR encryption with a single byte key (0x13) for string obfuscation. TmcLoader uses dynamic API resolution through circular XOR encryption combined with Base64 encoding to conceal API names. TmcPayload is decrypted in memory and injected into the svchost process, so no payload binary appears on disk. GoSerpent's command-line arguments are AES-CBC encrypted and base64-encoded before delivery. All tools use legitimate-sounding names. The network-share exfiltration channel looks identical to authorized file-copy operations.Unusual memory segments in svchost not associated with a loaded DLL; XOR-heavy strings in service DLLs; base64 command-line arguments; a process accessing a network share with credentials belonging to a different user account than the process owner.
Credential Access
LSASS Memory T1003.001Security Account Manager T1003.002Credentials in Files T1552.001
Mimikatz, deployed via GoSerpent, dumps the LSASS process to extract credential material including Kerberos tickets and cached credentials. QuarksDumpLocalHash extracts local account password hashes from the SAM registry hive, providing material for offline cracking. The stolen credentials serve a specific operational purpose: they are used weeks later by TmcPayload to authenticate to internal network shares for exfiltration, producing no unusual authentication events because the credentials are legitimate.LSASS handle access events with PROCESS_VM_READ from non-system processes (Event 10); mimikatz.exe or renamed variants; QuarksDumpLocalHash execution; SAM hive access from processes other than the Windows OS.
Discovery
File and Directory Discovery T1083System Information Discovery T1082
ThumbcacheService recursively scans the filesystem for documents with targeted extensions (.doc, .docx, .pdf, .xls, .xlsx), including the Recycle Bin for recently deleted files. The scanning is performed by a registered Windows service and is slow and persistent, not a rapid single-pass sweep, making it harder to distinguish from legitimate indexing services at the file-access level.A Windows service process performing high-volume reads across user document directories and the Recycle Bin; file access patterns with a narrow extension filter across many directories over an extended time window; creation of the thumbcache_605a.db file in C:\Users\Public\.
Lateral Movement
SMB/Windows Admin Shares T1021.002Multi-hop Proxy T1090.003
GoSerpent's Ss5 command establishes a SOCKS5 proxy on the compromised host, enabling the operator to route traffic through multiple compromised systems and mask the true origin of connections. Stowaway supports chained proxy paths across multiple hosts. TmcPayload uses SMB network shares with previously stolen credentials to transfer the collected data archive, mimicking legitimate file access.New SOCKS5 listeners established by a Go binary; long-lived outbound connections at unusual hours from government workstations; svchost accessing a network share with credentials differing from the session user; SMB connections to non-administrative shares from a service process.
Collection
Data from Local System T1005Archive via Utility T1560.001Local Data Staging T1074.001Data from Removable Media T1025
ThumbcacheService targets documents across the filesystem including deleted files still in the Recycle Bin. Found files are archived using 7-Zip with a predefined password (@vx0a9n5W2M0c3D6.#) and a 20MB per-archive size limit. The archives are written into a database file (thumbcache_605a.db) in the C:\Users\Public\ directory, a world-writable location, and staged there for later retrieval. The monitoring of the Recycle Bin suggests deliberate targeting of files the victim attempted to delete.7-Zip executing as a service child process; creation of thumbcache_605a.db in C:\Users\Public\; password-protected 7-Zip archives in a 20MB pattern; a Windows service reading .doc, .docx, .pdf, .xls, .xlsx across many directories; access to $Recycle.Bin by a service process.
Command and Control
Symmetric Cryptography T1573.001Multi-hop Proxy T1090.003Web Protocols T1071.001Non-Application Layer Protocol T1095
GoSerpent encrypts all C2 communications using ChaCha20, with the SHA256 hash of the communication password as the encryption key. Stowaway uses AES-256-GCM or TLS over TCP, HTTP, or WebSocket, and supports chained SOCKS5 paths across multiple hosts. Both GoSerpent and Stowaway embed legitimate domain names (www.microsoft.com, www.spacex.com, github.code) as secret keys, which is both a credential mechanism and an obfuscation approach. Infrastructure uses legitimate cloud hosting to blend with normal traffic.Encrypted outbound connections to Alibaba Cloud or UCLOUD HK IPs on non-standard ports; Go binary establishing SOCKS5 listeners; outbound HTTP or WebSocket sessions from system processes; ChaCha20-encrypted sessions that do not match known application profiles.
Exfiltration
Data from Network Shared Drive T1039SMB/Windows Admin Shares T1021.002Exfil Over Alternative Protocol T1048
TmcPayload reads an encrypted configuration file (delivered separately by Stowaway) containing network share credentials and destination paths. It then transfers thumbcache_605a.db to the attacker-controlled destination using the stolen credentials over internal SMB file shares. The transfer looks identical to an authorized employee moving files because it uses valid credentials to access a legitimate internal share. No external data connection occurs during exfiltration.svchost accessing a specific network share path using credentials not associated with the session user; transfer of thumbcache_605a.db; 7-Zip-format archives moved to a network share path matching a known destination pattern; SMB session authenticated by credentials previously seen in LSASS dump activity.
Reconnaissance / Privilege Escalation / Impact—No pre-attack reconnaissance or destructive impact has been documented. No privilege escalation techniques are described in current reporting; GoSerpent and the supporting tools operate with whatever privileges the initial foothold provides. The campaign is intelligence collection only.
Stage 1T1199 · T1036.005

How the attack starts

GoSerpent requires its C2 address and communication password to be provided as command-line arguments, making it an operator-deployed tool rather than a self-spreading one. The arguments are AES-CBC encrypted using a fixed initialization vector and keys derived from predefined strings, then base64-encoded, so inspection of the command line alone does not reveal the C2 destination. Earlier variants from 2021 received these arguments in plaintext; the transition to encrypted arguments in the 2025-2026 variant reflects deliberate tradecraft improvement.

Researchers who identified the campaign noted that even older, simpler GoSerpent versions continued to be deployed alongside the newer variant, suggesting the operator maintains both for different stages or environments. The simpler McMx variant reads its parameters from batch-generated plaintext configuration files, possibly used where the more sophisticated GoSerpent is harder to stage.

Once deployed, GoSerpent masquerades as legitimate system process names. The documented names, lass.exe (mimicking lsass.exe) and updates.exe (mimicking Windows Update processes), are chosen to survive brief visual inspection of a process list without triggering immediate suspicion. This masquerading is consistent across the campaign toolset: ThumbcacheService uses a plausible service name, and TmcLoader is also registered as a Windows service.

The exact delivery mechanism for the initial GoSerpent deployment in the 2025-2026 campaign has not been publicly disclosed. The probable link to TetrisPhantom and that group's history of USB-based delivery is relevant context, but this connection is not confirmed for this campaign. Defenders should not assume a specific delivery vector and should monitor for new Go binary executions on government endpoints regardless of how the process was started.

Stage 2 — Phase 1T1005 · T1560.001 · T1074.001 · T1003.001 · T1003.002

What runs on the endpoint in Phase 1

After establishing the GoSerpent foothold, the operator waits several days before downloading additional tooling. This gap is deliberate: it reduces the risk of triggering immediate incident response from deployment-time detections, and it lets the operator verify stable access before investing in the next stage.

ThumbcacheService. The file collection tool is a DLL deployed as a Windows service. It uses XOR encryption with the single-byte key 0x13 to obfuscate its embedded strings. On execution it creates a database file named thumbcache_605a.db in C:\Users\Public\, a world-writable directory that is accessible to service processes and does not require elevated write permissions. It then recursively searches for documents with the extensions .doc, .docx, .pdf, .xls, and .xlsx, archives found files using 7-Zip with the hardcoded password @vx0a9n5W2M0c3D6.# and a 20MB size limit, and stores the result in the database. Notably, it also monitors $Recycle.Bin for files with those same extensions, capturing documents the victim has recently deleted. The service runs silently for weeks, accumulating the collection.

Credential dumping. In parallel, GoSerpent deploys Mimikatz to dump the LSASS process and extract credential material including cached credentials and Kerberos tickets, and QuarksDumpLocalHash to extract local account password hashes from the SAM registry hive. These credentials are not immediately used for exfiltration; they are stored for the Phase 2 transfer operation that begins weeks later, when TmcPayload needs them to authenticate to internal network shares.

Stage 3T1027 · T1055 · T1036 · T1543.003

How the malware evades detection

The campaign's evasion is primarily architectural. The most distinctive detection-avoidance technique is the exfiltration method itself: TmcPayload does not establish any external connection. It moves data using stolen, legitimate credentials over an internal SMB network share, making the transfer indistinguishable from an authorized employee copying files. No firewall rule, no DLP alert for external destinations, and no unusual authentication event fires during this step.

At the tool level, each component uses its own obfuscation. ThumbcacheService XORs its strings with 0x13 to conceal file paths and API names from static analysis. TmcLoader resolves its API calls through a circular XOR, where each byte is XORed with the value of the subsequent byte, combined with Base64 encoding, a method that defeats simple string searches for API names. TmcPayload is decrypted in memory by TmcLoader and injected into the svchost process, so no TmcPayload binary appears on disk after deployment.

Process masquerading covers the primary foothold. The documented lass.exe name sits one character off from lsass.exe, a process every Windows administrator recognizes and is unlikely to look at closely when it appears in a process list among hundreds of other entries. The same logic applies to updates.exe. A defender scanning process names looking for obvious threats will miss both.

GoSerpent's command-line arguments arrive pre-encrypted. Monitoring for clear-text C2 addresses in command lines will not catch it; the decryption happens inside the binary. Behavioral monitoring of where the binary connects after startup is more reliable than command-line inspection.

Stage 4 — Phase 2T1090.003 · T1039 · T1021.002 · T1573.001

What it tries to access or modify

In May 2026, weeks after ThumbcacheService had silently accumulated its archive, the operator returned with a new toolset. The strategic delay between collection and exfiltration is a distinctive operational choice: data that does not move cannot be caught moving.

Stowaway. The Phase 2 primary access tool is compiled from an open-source Go proxy and remote access framework, with customizations added to make it stealthier. It supports SOCKS5 proxying, port forwarding, reverse tunneling, remote shell, file transfer, and SSH-based tunneling, over TCP, HTTP, or WebSocket channels protected by AES-256-GCM or TLS. Stowaway delivers two files to the target: TmcLoader (with TmcPayload embedded) and the encrypted configuration database.

TmcLoader and TmcPayload. TmcLoader registers as a Windows service and embeds TmcPayload in its .data section. On startup it decrypts and injects TmcPayload into a running svchost process. TmcPayload looks for a configuration file at a specific path: C:\Users\Public\Libraries\{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db. If the file does not exist, it delays for a random period and retries. The configuration file, delivered separately by Stowaway, contains the network share credentials and destination paths needed for exfiltration, and references thumbcache_605a.db by its exact filename as the file to transfer. The file path, filename, and credential format were designed to link directly to ThumbcacheService's output from Phase 1.

The result of this integration is a transfer that generates no external connection, uses legitimate credentials, and accesses an internal share path that a real authorized user might access. Without behavioral correlation across the two phases (ThumbcacheService creating the database, then svchost using different credentials to access a share containing it), the exfiltration step is invisible in standard monitoring.

Process tree

What the GoSerpent kill chain looks like in EDR telemetry

Where Malware Protection Plus fits

GoSerpent targets Windows endpoints in government and diplomatic environments. Several of its most reliable behavioral signals are visible in Windows endpoint telemetry. Malware Protection Plus focuses on the Windows-side behaviors that are detectable regardless of whether the network-share exfiltration is caught at the network layer.

The key behavioral signals on endpoint telemetry are: a new Windows service with a plausible-but-nonexistent name (ThumbcacheService, TmcLoader) creating or accessing files in C:\Users\Public\; Mimikatz or QuarksDumpLocalHash process execution; a Go binary running with long base64 command-line arguments; svchost reading a GUID-named database file and then authenticating to a network share with different credentials than the session user. Malware Protection Plus can detect these behaviors, isolate affected endpoints to interrupt lateral movement and further credential dumping, and preserve forensic artifacts for investigation.

Network-layer detection of the SMB exfiltration step, which uses legitimate credentials over internal shares, requires correlation with credential-theft events from an earlier phase. That cross-phase correlation is most effectively done with endpoint telemetry that captures the LSASS dump in Phase 1 and the svchost SMB session in Phase 2, connecting them as part of the same compromise timeline.

Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Durable indicators describe behaviors, file artifacts, and patterns that should persist across variant updates. Volatile indicators (hashes, IPs) are specific to documented samples and infrastructure and should be expected to change as the operator updates tooling and rotates servers.

Durable — process and file patterns

7 indicators

Behavioral and filesystem artifacts that should recur across GoSerpent variants and campaign updates.

  • lass.exe or updates.exe in non-system directoriesGoSerpent process masquerade; 'lass.exe' mimics lsass.exe
  • thumbcache_605a.db in C:\Users\Public\ThumbcacheService collection database; high-fidelity indicator
  • 7-Zip execution under a service process, password @vx0a9n5W2M0c3D6.#, 20MB archivesThumbcacheService archiving behavior; hardcoded archive password
  • {BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db in C:\Users\Public\Libraries\TmcPayload encrypted configuration file; high-fidelity artifact
  • svchost accessing a network share with credentials differing from the session userTmcPayload exfiltration; correlate with prior LSASS dump
  • Go binary execution with base64-encoded encrypted command-line argumentGoSerpent execution pattern; AES-CBC, fixed IV
  • Windows service reading $Recycle.Bin for .doc/.docx/.pdf/.xls/.xlsxThumbcacheService deleted-file monitoring; distinct from typical indexers

Durable — C2 behavioral patterns

3 patterns

Network and C2 behaviors that should persist even if infrastructure is rebuilt.

  • ChaCha20-encrypted outbound session to Alibaba Cloud / UCLOUD HK IPs on non-standard portsGoSerpent C2 channel; SHA256 of password as encryption key
  • SOCKS5 listener established by a Go binary on a government workstationGoSerpent Ss5 / Stowaway proxy capability
  • Strings www.microsoft.com or www.spacex.com as embedded keys in Go binaryGoSerpent hardcoded secret key strings; static analysis signature

Volatile — file hashes (MD5)

Volatile · rotate on rebuild

Hashes from documented samples. Use as confirmation aids; these rotate as the operator recompiles tooling.

  • EBFFD5A76AAA690BCDB922F82E0BACC5 · DC506FF7BB72735444FB3703A6BEE6D8GoSerpent backdoor samples (MD5)
  • D6E86BF8A90E9B632ADD5FA495F97FBCMcMx RAT (MD5)
  • CB6C4C70A3B171FA3404B8E1A3382116 · 64E9D1950E42BC98486DFD9919463D1CThumbcacheService DLL samples (MD5)
  • CBBB6D483737EA3566726E51752DFF40 · 7F223EE0716CE2AD56F55D3744419449 · 19F8BEFCB035F52BF70094E6B4F5779A · 846EF7C1C7323849B2A778C5E4CDA162Stowaway RAT samples (MD5)
  • D08A059E8B815E3B891505BC8777FC28 · 93A1569D5D5AB2C4761FEDF84F83709ETmcLoader samples (MD5)

Volatile — C2 IP addresses

Volatile · expect rotation

C2 infrastructure from documented samples. All hosted on Alibaba Cloud and UCLOUD HK.

  • 152.32.160[.]239 · 152.32.222[.]113Documented C2 IPs from analyzed samples
  • 8.220.194[.]108 · 8.220.214[.]132 · 8.220.209[.]155 · 8.220.193[.]189Alibaba Cloud C2 range from analyzed samples
  • 101.36.104[.]87 · 144.48.6[.]46 · 103.138.13[.]30 · 47.80.22[.]58 · 43.106.30[.]226Additional documented C2 IPs

Detection guidance

GoSerpent's most detectable window is Phase 1, when ThumbcacheService is accumulating files and credential dumpers are running. By Phase 2, a long-term foothold is already established, and the exfiltration step is designed to appear as authorized file movement. Detection must span both phases and correlate events that may be weeks apart.

  1. 01

    GoSerpent process masquerade detection

    Process telemetry / EDR

    Alert on processes named lass.exe or updates.exe executing from paths other than %SystemRoot%\System32\. Extend this to any process whose name is within one character of a known Windows system process (LSASS, svchost, services, csrss) and is not executing from the expected system path.

    Why it works: GoSerpent deliberately mimics lsass.exe with a one-character substitution. This is a known masquerade technique; checking process image path against process name catches it reliably and has very few legitimate false positives on managed endpoints.

  2. 02

    ThumbcacheService database creation

    File integrity / EDR

    Alert on the creation of thumbcache_605a.db in C:\Users\Public\ by any process. Separately, alert on a Windows service process reading $Recycle.Bin for .doc, .docx, .pdf, .xls, or .xlsx files, or spawning 7-Zip with a password argument.

    Why it works: the filename is hardcoded in the malware. Creation of this specific file by a non-indexing service process is a high-confidence signal. A service reading the Recycle Bin for document extensions has no legitimate administrative use case.

  3. 03

    LSASS and SAM credential dumping

    EDR / process telemetry

    Alert on Mimikatz execution (by hash, name, or behavioral signature) and on any process accessing LSASS with PROCESS_VM_READ rights. Alert on QuarksDumpLocalHash execution or any process reading the SAM registry hive outside of Windows backup or authentication services.

    Why it works: credential dumping in Phase 1 is prerequisite to the Phase 2 exfiltration. These tools have no legitimate use on a government workstation and are individually high-confidence indicators of compromise. Detecting either tool immediately raises the question of what else has already been deployed.

  4. 04

    New Windows service with implausible-but-plausible name

    Service / Event ID 7045

    Monitor Event ID 7045 (new service installed) and alert on services whose names match common Windows service names but are not present in the approved service baseline. Specifically alert on any service loading a DLL from C:\Users\Public\ or %TEMP%.

    Why it works: both ThumbcacheService and TmcLoader register as Windows services. Service names like ThumbcacheService are designed to look like Windows thumbnail cache management, but they are not legitimate Windows services. Event ID 7045 fires on every service creation and is not suppressed by the malware.

  5. 05

    TmcPayload injected into svchost

    Process injection / memory telemetry

    Monitor for svchost process anomalies: memory regions not backed by a loaded module on disk, network connections established by svchost that do not match the expected service DLLs for that instance, or svchost reading a GUID-named .db file from C:\Users\Public\Libraries\.

    Why it works: TmcPayload is injected into svchost in memory; no .exe or .dll for TmcPayload appears on disk. Any svchost instance accessing the specific GUID-named configuration file is executing injected code. Cross-referencing with prior LSASS dump events establishes the two-phase timeline.

  6. 06

    SMB authentication with mismatched credentials

    Authentication / network telemetry

    Alert on network share access where the authenticating account differs from the currently logged-on user in the same session, particularly from a service process. On a government workstation, svchost authenticating to an internal SMB share using a specific named account should be compared against that account's normal access patterns.

    Why it works: TmcPayload uses credentials stolen in Phase 1 to authenticate to the network share in Phase 2. The process context (svchost) and the authenticating account will differ, which is anomalous and correlatable with the earlier LSASS dump event from the same host.

  7. 07

    Go binary with base64 encrypted command-line arguments

    Process telemetry / command-line logging

    Alert on Go-compiled binaries executing with command-line arguments that are entirely base64-encoded strings exceeding 40 characters in length, particularly when the binary is not in a known application directory.

    Why it works: GoSerpent's encrypted argument passing is unusual; legitimate Go applications rarely receive their entire configuration as a single opaque base64 argument at runtime. This pattern is consistent across GoSerpent variants and survives recompilation that changes the binary hash.

Hardening and response recommendations

The GoSerpent campaign depends on unmonitored credential access, services without behavioral baselines, and the ability to use stolen credentials on internal network shares weeks after theft. The controls below target those dependencies. Quick win = single configuration change, deployable in days. Standard = needs rollout or architectural change, deployable in weeks.

  1. Protect LSASS with Credential Guard and RunAsPPL

    Critical

    Credential Guard isolates LSASS secrets inside a virtualization-based security boundary, making them inaccessible to both Mimikatz-style memory reads and Go-based credential dumpers even when the attacker has local admin access. Protected LSASS (RunAsPPL) requires a valid kernel driver signature to open LSASS for memory reading and blocks the comsvcs.dll MiniDump pattern.

    Path: Computer Configuration → Administrative Templates → System → Device Guard. Credential Guard requires TPM 2.0 and Secure Boot. Enable RunAsPPL through the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1. If LSASS credentials cannot be dumped, the stolen credentials needed for the Phase 2 network-share exfiltration cannot be obtained.

  2. Monitor and baseline Windows services rigorously

    Quick win

    Every tool in the GoSerpent campaign except GoSerpent itself uses a Windows service for persistence or execution. Alerting on Event ID 7045 for any service not present in an approved baseline is one of the highest-fidelity controls available for this campaign, and it catches both ThumbcacheService and TmcLoader.

    Do: build and maintain a service baseline for government endpoints. Forward Event ID 7045 to your SIEM and alert on any new service installation that does not match a change-management record. Services loading DLLs from user-writable directories (Public, Temp, AppData) warrant immediate investigation.

  3. Apply process name and path verification for system processes

    Quick win

    GoSerpent masquerades as lass.exe and updates.exe. Detection requires knowing not just the process name but where it is running from. lsass.exe is only legitimate from %SystemRoot%\System32\. Any process with a similar name from any other path is masquerading.

    Do: configure SIEM or EDR rules to alert on process image names that phonetically or visually resemble core Windows system processes (lsass, svchost, services, csrss, winlogon) but execute from non-system directories. This catches GoSerpent regardless of which specific name it uses.

  4. Restrict and monitor access to C:\Users\Public\

    Standard

    ThumbcacheService stages its collection database and TmcPayload stores its configuration file in C:\Users\Public\ and C:\Users\Public\Libraries\ because these directories are world-writable without elevation. Monitoring file creation in these paths from service processes, and restricting executable and DLL loading from these directories, reduces the value of these staging locations.

    Do: alert on creation of database files in C:\Users\Public\ by non-user processes. Apply AppLocker or WDAC policies that prevent DLL loading from user-writable directories. This does not prevent the campaign but forces the operator to use a more detectable staging path.

  5. Audit and restrict network share access from service accounts

    Standard

    TmcPayload exfiltrates by using stolen credentials to authenticate to an internal network share. The transfer is indistinguishable from legitimate file access because the credentials are real. Detecting it requires logging what credentials are used to authenticate to shares and comparing that against expected access patterns.

    Do: enable SMB audit logging (Object Access, Event IDs 5140/5145). Alert on share access authenticated by credentials that belong to an account different from the process owner. Implement least-privilege access to file shares so that a single compromised credential set has limited reach. Time-bound access tokens for internal shares reduce the window in which stolen credentials remain valid.

  6. Respond: isolate, rotate credentials, correlate across the full timeline

    Quick win

    On suspected GoSerpent activity, isolate the affected endpoint before investigating to prevent further credential use. Preserve forensic artifacts before remediation: memory images, Windows Event Logs (4624, 4625, 7045, 4688, 5140), and any files in C:\Users\Public\. Rotate all credentials accessible to the compromised host, including network share credentials, not only the logged-on user account. Hunt for the thumbcache_605a.db and the GUID-named config file as post-compromise indicators on all adjacent hosts.

    Do: because GoSerpent is a two-phase campaign, investigating only the most recent event will miss the earlier phase. The LSASS dump and ThumbcacheService events may be weeks old in the log by the time the SMB exfiltration is detected. Extend log retention for government endpoints to cover at least 90 days and confirm that Event ID 7045, 4688, and 5140 are being forwarded off-host before they can be cleared.

Primary references

Source material this page is built on. All technical claims trace to the original security research first published in July 2026. MITRE ATT&CK provided the technique framework. Reviewed through August 2026.

Detect GoSerpent's two-phase foothold before the data leaves the network.

Malware Protection Plus helps security teams detect credential-dumping behavior, suspicious service installations, and process masquerading on Windows government endpoints, isolate affected systems, and correlate Phase 1 and Phase 2 events for faster investigation.

Start free trial →