# GoSerpent

Go-based RAT · Cyber-espionage · Government and diplomatic targets · Southeast Asia · Active since 2021

## Overview

GoSerpent is a Go-based remote access trojan first publicly documented in July 2026, identified in a cyber-espionage campaign targeting government and diplomatic entities in Southeast Asia. [Security researchers who uncovered the activity in February 2026 found that attacks had been ongoing since late 2025](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html), with earlier variants of the backdoor traced as far back as 2021. The campaign demonstrates a patient, multi-stage approach built entirely around long-term access and intelligence collection.

GoSerpent is the primary foothold tool, but the campaign is better understood as a coordinated toolkit. In Phase 1, GoSerpent deploys ThumbcacheService, a malicious Windows service that silently archives sensitive documents and monitors the Recycle Bin, alongside credential-dumping utilities. No data leaves the environment during this phase; the operator waits weeks while the collection accumulates. In May 2026, Phase 2 began: the operator returned with Stowaway, a customized open-source Go-based RAT, and deployed TmcLoader and TmcPayload, a two-stage exfiltration chain that uses the previously stolen credentials to transfer the archived file database through internal network shares, generating no external connections and no unusual authentication events.

[The deliberate integration between the two phases distinguishes this campaign from commodity malware](https://gbhackers.com/goserpent-steals-government-files/). ThumbcacheService writes its output to a specific file, `thumbcache_605a.db`. The TmcPayload configuration file, delivered weeks later by Stowaway, references that exact filename and the network share path to receive it. The tool chain was designed to work together, not assembled opportunistically.

Attribution remains uncertain. The victim profile and technical approach show similarities to TetrisPhantom, an APT group first documented in 2023 for targeting APAC government entities by compromising hardware-encrypted USB drives. That connection is assessed as probable but unconfirmed.

**Why this matters for defenders:** GoSerpent's most dangerous property is patience. Both the credential theft and the file collection run silently for an extended period before exfiltration begins. By the time the data moves, the theft has already happened. Detection must focus on the pre-exfiltration behaviors: a service with a plausible name writing an unusual database, a LSASS dumper running in an enterprise that does not have a legitimate use for one, and a process injected into svchost that accesses a specific file path and authenticates to a network share with credentials belonging to a different user.

**Verify before relying on this:** the exact initial delivery mechanism for the 2025-2026 campaign has not been publicly detailed. Attribution to TetrisPhantom is assessed as probable, not confirmed. Treat infrastructure indicators as time-limited.

### Threat profile

| Detail | Value |
|---|---|
| Type | Go-based RAT / Espionage |
| Active since | `2021 (variant 2025)` |
| Campaign | Two-phase, late 2025 ongoing |
| Status | Active (2026) |
| Targets | Government · Diplomatic · Southeast Asia |
| Campaign tools | GoSerpent · McMx · ThumbcacheService · Stowaway · TmcLoader · TmcPayload |
| C2 encryption | ChaCha20 (GoSerpent) · AES-256-GCM / TLS (Stowaway) |
| Credential dumpers | Mimikatz · QuarksDumpLocalHash |
| Exfiltration method | Internal network shares via stolen credentials |
| C2 infrastructure | Alibaba Cloud · UCLOUD HK |
| Attribution | TetrisPhantom (probable, unconfirmed) |

## Operational attack chain

1. **GoSerpent deployed**
   - Go-based RAT with encrypted C2 arguments; masquerades as `lass.exe` or `updates.exe`.

2. **McMx supplementary access**
   - Simpler Go-based variant; configured via batch-generated plaintext configuration files.

3. **Phase 1: ThumbcacheService**
   - Malicious DLL service archives `.doc`, `.docx`, `.pdf`, `.xls`, and `.xlsx` files and the Recycle Bin into `thumbcache_605a.db`.
   - Waits weeks.
   - MITRE ATT&CK: `T1005`, `T1560.001`

4. **Credential dumping**
   - Mimikatz dumps LSASS, and QuarksDumpLocalHash extracts SAM-hive hashes to harvest domain and local hashes for later use.
   - MITRE ATT&CK: `T1003.001`, `T1003.002`

5. **Phase 2: Stowaway RAT**
   - Custom Go RAT over AES-256-GCM/TLS, TCP, HTTP, or WebSocket; supports multi-hop SOCKS5.
   - Delivers the Phase 2 payload.
   - MITRE ATT&CK: `T1090.003`

6. **TmcLoader injects TmcPayload**
   - C++ service loader decrypts TmcPayload and injects it into `svchost` memory.
   - Reads encrypted configuration for share credentials.
   - MITRE ATT&CK: `T1055`, `T1543.003`

7. **Exfiltration via network share**
   - TmcPayload transfers `thumbcache_605a.db` using stolen credentials over internal SMB shares.
   - No external connection; indistinguishable from authorized file copying.
   - MITRE ATT&CK: `T1039`, `T1021.002`

The deliberate gap between Phase 1, which collects data, and Phase 2, which exfiltrates it, is the campaign's defining operational choice. Files accumulate for weeks inside the environment before anything moves. By the time data leaves, its theft has already happened. Detection must cover both phases independently.

## Tactics, techniques, and procedures

GoSerpent campaigns concentrate in Credential Access, Collection, Defense Evasion, and Command and Control, with Exfiltration deliberately routed through internal network shares rather than external connections. The campaign does not involve destructive impact; the objective is intelligence collection sustained over months.

### MITRE ATT&CK coverage

| Tactic | Coverage |
|---|---:|
| Reconnaissance | 0 — Not observed |
| Resource Development | 2 — Active |
| Initial Access | 1 — Active |
| Execution | 3 — Active |
| Persistence | 3 — Heavy |
| Privilege Escalation | 0 — Not observed |
| Defense Evasion | 4 — Heavy |
| Credential Access | 3 — Heavy |
| Discovery | 2 — Active |
| Lateral Movement | 2 — Active |
| Collection | 4 — Heavy |
| Command and Control | 4 — Heavy |
| Exfiltration | 3 — Heavy |
| Impact | 0 — Not observed |

### Technique detail

| Tactic | Techniques | What GoSerpent does | Defender telemetry |
|---|---|---|---|
| Resource Development | [Virtual Private Server T1583.003](https://attack.mitre.org/techniques/T1583/003/); [Domains T1583.001](https://attack.mitre.org/techniques/T1583/001/) | C2 infrastructure uses legitimate cloud hosting providers, including Alibaba Cloud and UCLOUD HK, to blend with normal enterprise traffic to hosted services. GoSerpent uses legitimate domain names as embedded secret keys (`www.microsoft.com`, `www.spacex.com`); Stowaway uses `github.code`, indicating a consistent methodology across tooling generations. | C2 connections to Alibaba Cloud and UCLOUD HK IP ranges that are not associated with any business service; embedded domain strings in Go binaries extracted during static analysis. |
| Initial Access | [Trusted Relationship T1199](https://attack.mitre.org/techniques/T1199/) | The exact initial delivery mechanism for the 2025-2026 campaign has not been publicly documented. GoSerpent requires correct encrypted command-line arguments to operate, indicating operator-controlled deployment rather than self-spreading. The probable TetrisPhantom connection suggests prior use of trusted-channel access through hardware-encrypted USB drives; whether that vector was used in this campaign is unconfirmed. | First-seen execution of a Go-compiled binary with command-line arguments containing long base64-encoded strings; new processes masquerading as system names (`lass.exe`, `updates.exe`) in user-writable directories. |
| Execution | [Service Execution T1569.002](https://attack.mitre.org/techniques/T1569/002/); [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/); [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/) | ThumbcacheService and TmcLoader execute as registered Windows services. McMx is deployed by batch files using `echo` commands to write configuration files containing C2 parameters before executing the binary with those parameters. GoSerpent's remote shell command (`Ss5` / `Hello`) can open interactive command access on the compromised host. | New service installation events, Event ID 7045, for ThumbcacheService and TmcLoader; `cmd.exe` with `echo` commands writing configuration files; process creation of Go binaries with base64 command-line arguments. |
| Persistence | [Windows Service T1543.003](https://attack.mitre.org/techniques/T1543/003/); [Match Legitimate Name T1036.005](https://attack.mitre.org/techniques/T1036/005/); [Registry Run Keys T1547.001](https://attack.mitre.org/techniques/T1547/001/) | ThumbcacheService and TmcLoader both register as Windows services, surviving reboots. GoSerpent masquerades as legitimate system process names, such as `lass.exe` mimicking `lsass.exe` and `updates.exe` mimicking Windows Update processes, to evade visual inspection. | Service creation for ThumbcacheService or TmcLoader, Event ID 7045; `lass.exe` or `updates.exe` executing from non-system directories; services registered with legitimate-sounding names that do not appear in the approved software baseline. |
| Defense Evasion | [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/); [Process Injection T1055](https://attack.mitre.org/techniques/T1055/); [Masquerading T1036](https://attack.mitre.org/techniques/T1036/); [Deobfuscate/Decode T1140](https://attack.mitre.org/techniques/T1140/) | ThumbcacheService uses XOR encryption with a single-byte key, `0x13`, for string obfuscation. TmcLoader uses dynamic API resolution through circular XOR encryption combined with Base64 encoding. TmcPayload is decrypted in memory and injected into `svchost`, so no payload binary appears on disk. GoSerpent command-line arguments are AES-CBC encrypted and base64-encoded before delivery. All tools use legitimate-sounding names. | Unusual memory segments in `svchost` not associated with a loaded DLL; XOR-heavy strings in service DLLs; base64 command-line arguments; a process accessing a network share with credentials belonging to a different user account than the process owner. |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/); [Security Account Manager T1003.002](https://attack.mitre.org/techniques/T1003/002/); [Credentials in Files T1552.001](https://attack.mitre.org/techniques/T1552/001/) | Mimikatz, deployed via GoSerpent, dumps LSASS to extract credential material including Kerberos tickets and cached credentials. QuarksDumpLocalHash extracts local account password hashes from the SAM registry hive. The stolen credentials are used weeks later by TmcPayload to authenticate to internal network shares for exfiltration. | LSASS handle access events with `PROCESS_VM_READ` from non-system processes, Event 10; `mimikatz.exe` or renamed variants; QuarksDumpLocalHash execution; SAM hive access from processes other than the Windows OS. |
| Discovery | [File and Directory Discovery T1083](https://attack.mitre.org/techniques/T1083/); [System Information Discovery T1082](https://attack.mitre.org/techniques/T1082/) | ThumbcacheService recursively scans the filesystem for documents with targeted extensions, including `.doc`, `.docx`, `.pdf`, `.xls`, and `.xlsx`, including the Recycle Bin for recently deleted files. The scanning is performed by a registered Windows service and is slow and persistent. | A Windows service process performing high-volume reads across user document directories and the Recycle Bin; file access patterns with a narrow extension filter across many directories over an extended time window; creation of `thumbcache_605a.db` in `C:\Users\Public\`. |
| Lateral Movement | [SMB/Windows Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/); [Multi-hop Proxy T1090.003](https://attack.mitre.org/techniques/T1090/003/) | GoSerpent's `Ss5` command establishes a SOCKS5 proxy on the compromised host, enabling the operator to route traffic through multiple compromised systems. Stowaway supports chained proxy paths. TmcPayload uses SMB network shares with previously stolen credentials to transfer the collected data archive. | New SOCKS5 listeners established by a Go binary; long-lived outbound connections at unusual hours from government workstations; `svchost` accessing a network share with credentials differing from the session user; SMB connections to non-administrative shares from a service process. |
| Collection | [Data from Local System T1005](https://attack.mitre.org/techniques/T1005/); [Archive via Utility T1560.001](https://attack.mitre.org/techniques/T1560/001/); [Local Data Staging T1074.001](https://attack.mitre.org/techniques/T1074/001/); [Data from Removable Media T1025](https://attack.mitre.org/techniques/T1025/) | ThumbcacheService targets documents across the filesystem, including deleted files still in the Recycle Bin. Found files are archived using 7-Zip with the predefined password `@vx0a9n5W2M0c3D6.#` and a 20MB per-archive size limit. Archives are written into `thumbcache_605a.db` in `C:\Users\Public\` and staged for later retrieval. | 7-Zip executing as a service child process; creation of `thumbcache_605a.db` in `C:\Users\Public\`; password-protected 7-Zip archives in a 20MB pattern; a Windows service reading targeted document types across many directories; access to `$Recycle.Bin` by a service process. |
| Command and Control | [Symmetric Cryptography T1573.001](https://attack.mitre.org/techniques/T1573/001/); [Multi-hop Proxy T1090.003](https://attack.mitre.org/techniques/T1090/003/); [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/); [Non-Application Layer Protocol T1095](https://attack.mitre.org/techniques/T1095/) | GoSerpent encrypts C2 communications using ChaCha20, with the SHA256 hash of the communication password as the encryption key. Stowaway uses AES-256-GCM or TLS over TCP, HTTP, or WebSocket and supports chained SOCKS5 paths. Both GoSerpent and Stowaway embed legitimate domain names as secret keys. | Encrypted outbound connections to Alibaba Cloud or UCLOUD HK IPs on non-standard ports; Go binary establishing SOCKS5 listeners; outbound HTTP or WebSocket sessions from system processes; ChaCha20-encrypted sessions that do not match known application profiles. |
| Exfiltration | [Data from Network Shared Drive T1039](https://attack.mitre.org/techniques/T1039/); [SMB/Windows Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/); [Exfil Over Alternative Protocol T1048](https://attack.mitre.org/techniques/T1048/) | TmcPayload reads an encrypted configuration file containing network-share credentials and destination paths. It transfers `thumbcache_605a.db` to an attacker-controlled destination using stolen credentials over internal SMB file shares. No external data connection occurs during exfiltration. | `svchost` accessing a specific network share path using credentials not associated with the session user; transfer of `thumbcache_605a.db`; 7-Zip-format archives moved to a network share path matching a known destination pattern; SMB session authenticated by credentials previously seen in LSASS dump activity. |
| Reconnaissance / Privilege Escalation / Impact | — | No pre-attack reconnaissance or destructive impact has been documented. No privilege escalation techniques are described in current reporting; GoSerpent and the supporting tools operate with whatever privileges the initial foothold provides. The campaign is intelligence collection only. |  |

### Stage 1: How the attack starts

GoSerpent requires its C2 address and communication password to be provided as command-line arguments, making it an operator-deployed tool rather than a self-spreading one. The arguments are AES-CBC encrypted using a fixed initialization vector and keys derived from predefined strings, then base64-encoded, so inspection of the command line alone does not reveal the C2 destination. Earlier variants from 2021 received these arguments in plaintext; the transition to encrypted arguments in the 2025-2026 variant reflects deliberate tradecraft improvement.

[Researchers who identified the campaign noted that even older, simpler GoSerpent versions continued to be deployed alongside the newer variant](https://cybernews.com/news/goserpent-malware-spies-southeast-asia/), suggesting the operator maintains both for different stages or environments. The simpler McMx variant reads its parameters from batch-generated plaintext configuration files, possibly used where the more sophisticated GoSerpent is harder to stage.

Once deployed, GoSerpent masquerades as legitimate system process names. The documented names, `lass.exe`, which mimics `lsass.exe`, and `updates.exe`, which mimics Windows Update processes, are chosen to survive brief visual inspection of a process list without triggering immediate suspicion. This masquerading is consistent across the campaign toolset: ThumbcacheService uses a plausible service name, and TmcLoader is also registered as a Windows service.

The exact delivery mechanism for the initial GoSerpent deployment in the 2025-2026 campaign has not been publicly disclosed. The probable link to TetrisPhantom and that group's history of USB-based delivery is relevant context, but this connection is not confirmed for this campaign. Defenders should not assume a specific delivery vector and should monitor for new Go binary executions on government endpoints regardless of how the process was started.

### Stage 2: What runs on the endpoint in Phase 1

After establishing the GoSerpent foothold, the operator waits several days before downloading additional tooling. This gap is deliberate: it reduces the risk of triggering immediate incident response from deployment-time detections, and it lets the operator verify stable access before investing in the next stage.

**ThumbcacheService.** The file collection tool is a DLL deployed as a Windows service. It uses XOR encryption with the single-byte key `0x13` to obfuscate its embedded strings. On execution it creates a database file named `thumbcache_605a.db` in `C:\Users\Public\`, a world-writable directory that is accessible to service processes and does not require elevated write permissions. It then recursively searches for documents with the extensions `.doc`, `.docx`, `.pdf`, `.xls`, and `.xlsx`, archives found files using 7-Zip with the hardcoded password `@vx0a9n5W2M0c3D6.#` and a 20MB size limit, and stores the result in the database. Notably, it also monitors `$Recycle.Bin` for files with those same extensions, capturing documents the victim has recently deleted. The service runs silently for weeks, accumulating the collection.

**Credential dumping.** In parallel, GoSerpent deploys Mimikatz to dump the LSASS process and extract credential material including cached credentials and Kerberos tickets, and QuarksDumpLocalHash to extract local account password hashes from the SAM registry hive. These credentials are not immediately used for exfiltration; they are stored for the Phase 2 transfer operation that begins weeks later, when TmcPayload needs them to authenticate to internal network shares.

### Stage 3: How the malware evades detection

The campaign's evasion is primarily architectural. The most distinctive detection-avoidance technique is the exfiltration method itself: TmcPayload does not establish any external connection. It moves data using stolen, legitimate credentials over an internal SMB network share, making the transfer indistinguishable from an authorized employee copying files. No firewall rule, no DLP alert for external destinations, and no unusual authentication event fires during this step.

At the tool level, each component uses its own obfuscation. ThumbcacheService XORs its strings with `0x13` to conceal file paths and API names from static analysis. TmcLoader resolves its API calls through a circular XOR, where each byte is XORed with the value of the subsequent byte, combined with Base64 encoding, a method that defeats simple string searches for API names. TmcPayload is decrypted in memory by TmcLoader and injected into the `svchost` process, so no TmcPayload binary appears on disk after deployment.

Process masquerading covers the primary foothold. The documented `lass.exe` name sits one character off from `lsass.exe`, a process every Windows administrator recognizes and is unlikely to look at closely when it appears in a process list among hundreds of other entries. The same logic applies to `updates.exe`. A defender scanning process names looking for obvious threats will miss both.

GoSerpent's command-line arguments arrive pre-encrypted. Monitoring for clear-text C2 addresses in command lines will not catch it; the decryption happens inside the binary. Behavioral monitoring of where the binary connects after startup is more reliable than command-line inspection.

### Stage 4: What it tries to access or modify

In May 2026, weeks after ThumbcacheService had silently accumulated its archive, the operator returned with a new toolset. [The strategic delay between collection and exfiltration is a distinctive operational choice: data that does not move cannot be caught moving.](https://www.techradar.com/pro/security/dangerous-new-goserpent-malware-is-apparently-on-the-hunt-for-government-secrets)

**Stowaway.** The Phase 2 primary access tool is compiled from an open-source Go proxy and remote access framework, with customizations added to make it stealthier. It supports SOCKS5 proxying, port forwarding, reverse tunneling, remote shell, file transfer, and SSH-based tunneling, over TCP, HTTP, or WebSocket channels protected by AES-256-GCM or TLS. Stowaway delivers two files to the target: TmcLoader, with TmcPayload embedded, and the encrypted configuration database.

**TmcLoader and TmcPayload.** TmcLoader registers as a Windows service and embeds TmcPayload in its `.data` section. On startup it decrypts and injects TmcPayload into a running `svchost` process. TmcPayload looks for a configuration file at this path:

`C:\Users\Public\Libraries\{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db`

If the file does not exist, it delays for a random period and retries. The configuration file, delivered separately by Stowaway, contains the network-share credentials and destination paths needed for exfiltration, and references `thumbcache_605a.db` by its exact filename as the file to transfer. The file path, filename, and credential format were designed to link directly to ThumbcacheService's output from Phase 1.

The result of this integration is a transfer that generates no external connection, uses legitimate credentials, and accesses an internal share path that a real authorized user might access. Without behavioral correlation across the two phases, ThumbcacheService creating the database and then `svchost` using different credentials to access a share containing it, the exfiltration step is invisible in standard monitoring.

### Process tree

```text
lass.exe / updates.exe
├─ ChaCha20 session → [C2 at Alibaba Cloud / UCLOUD HK]
├─ mimikatz.exe
├─ QuarksDumpLocalHash.exe
└─ ThumbcacheService.dll
   └─ 7z.exe a -p@vx0a9n5W2M0c3D6.# thumbcache_605a.db [matched docs]
      └─ monitors $Recycle.Bin

[weeks pass; data accumulates in thumbcache_605a.db in C:\Users\Public\]

Stowaway RAT
└─ TmcLoader.dll
   └─ svchost.exe [TmcPayload injected]
      ├─ reads config {BBF061R2-...}.db
      └─ \\[internal-share]\[path]\thumbcache_605a.db

No external connection; authenticated with stolen domain credentials.
```

## Where Malware Protection Plus fits

GoSerpent targets Windows endpoints in government and diplomatic environments. Several of its most reliable behavioral signals are visible in Windows endpoint telemetry. [Malware Protection Plus](https://www.manageengine.com/malware-protection/) focuses on the Windows-side behaviors that are detectable regardless of whether the network-share exfiltration is caught at the network layer.

The key behavioral signals on endpoint telemetry are: a new Windows service with a plausible-but-nonexistent name, such as ThumbcacheService or TmcLoader, creating or accessing files in `C:\Users\Public\`; Mimikatz or QuarksDumpLocalHash process execution; a Go binary running with long base64 command-line arguments; `svchost` reading a GUID-named database file and then authenticating to a network share with different credentials than the session user. Malware Protection Plus can detect these behaviors, isolate affected endpoints to interrupt lateral movement and further credential dumping, and preserve forensic artifacts for investigation.

Network-layer detection of the SMB exfiltration step, which uses legitimate credentials over internal shares, requires correlation with credential-theft events from an earlier phase. That cross-phase correlation is most effectively done with endpoint telemetry that captures the LSASS dump in Phase 1 and the `svchost` SMB session in Phase 2, connecting them as part of the same compromise timeline.

## Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Durable indicators describe behaviors, file artifacts, and patterns that should persist across variant updates. Volatile indicators, including hashes and IPs, are specific to documented samples and infrastructure and should be expected to change as the operator updates tooling and rotates servers.

### Durable — process and file patterns

- `lass.exe` or `updates.exe` in non-system directories
  - GoSerpent process masquerade; `lass.exe` mimics `lsass.exe`.
- `thumbcache_605a.db` in `C:\Users\Public\`
  - ThumbcacheService collection database; high-fidelity indicator.
- 7-Zip execution under a service process, password `@vx0a9n5W2M0c3D6.#`, 20MB archives
  - ThumbcacheService archiving behavior; hardcoded archive password.
- `{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db` in `C:\Users\Public\Libraries\`
  - TmcPayload encrypted configuration file; high-fidelity artifact.
- `svchost` accessing a network share with credentials differing from the session user
  - TmcPayload exfiltration; correlate with prior LSASS dump.
- Go binary execution with base64-encoded encrypted command-line argument
  - GoSerpent execution pattern; AES-CBC with a fixed IV.
- Windows service reading `$Recycle.Bin` for `.doc`, `.docx`, `.pdf`, `.xls`, or `.xlsx`
  - ThumbcacheService deleted-file monitoring; distinct from typical indexers.

### Durable — C2 behavioral patterns

- ChaCha20-encrypted outbound session to Alibaba Cloud or UCLOUD HK IPs on non-standard ports
  - GoSerpent C2 channel; SHA256 of password as encryption key.
- SOCKS5 listener established by a Go binary on a government workstation
  - GoSerpent `Ss5` or Stowaway proxy capability.
- Strings `www.microsoft.com` or `www.spacex.com` as embedded keys in a Go binary
  - GoSerpent hardcoded secret key strings; static-analysis signature.

### Volatile — file hashes (MD5)

| Hash | Artifact |
|---|---|
| `EBFFD5A76AAA690BCDB922F82E0BACC5` | GoSerpent backdoor sample |
| `DC506FF7BB72735444FB3703A6BEE6D8` | GoSerpent backdoor sample |
| `D6E86BF8A90E9B632ADD5FA495F97FBC` | McMx RAT |
| `CB6C4C70A3B171FA3404B8E1A3382116` | ThumbcacheService DLL sample |
| `64E9D1950E42BC98486DFD9919463D1C` | ThumbcacheService DLL sample |
| `CBBB6D483737EA3566726E51752DFF40` | Stowaway RAT sample |
| `7F223EE0716CE2AD56F55D3744419449` | Stowaway RAT sample |
| `19F8BEFCB035F52BF70094E6B4F5779A` | Stowaway RAT sample |
| `846EF7C1C7323849B2A778C5E4CDA162` | Stowaway RAT sample |
| `D08A059E8B815E3B891505BC8777FC28` | TmcLoader sample |
| `93A1569D5D5AB2C4761FEDF84F83709E` | TmcLoader sample |

### Volatile — C2 IP addresses

All documented infrastructure was hosted on Alibaba Cloud and UCLOUD HK.

- `152.32.160[.]239`
- `152.32.222[.]113`
- `8.220.194[.]108`
- `8.220.214[.]132`
- `8.220.209[.]155`
- `8.220.193[.]189`
- `101.36.104[.]87`
- `144.48.6[.]46`
- `103.138.13[.]30`
- `47.80.22[.]58`
- `43.106.30[.]226`

## Detection guidance

GoSerpent's most detectable window is Phase 1, when ThumbcacheService is accumulating files and credential dumpers are running. By Phase 2, a long-term foothold is already established, and the exfiltration step is designed to appear as authorized file movement. Detection must span both phases and correlate events that may be weeks apart.

1. ### GoSerpent process masquerade detection

   **Telemetry:** Process telemetry / EDR

   Alert on processes named `lass.exe` or `updates.exe` executing from paths other than `%SystemRoot%\System32\`. Extend this to any process whose name is within one character of a known Windows system process, including LSASS, `svchost`, `services`, or `csrss`, and is not executing from the expected system path.

   **Why it works:** GoSerpent deliberately mimics `lsass.exe` with a one-character substitution. Checking the process image path against the process name catches it reliably and has very few legitimate false positives on managed endpoints.

2. ### ThumbcacheService database creation

   **Telemetry:** File integrity / EDR

   Alert on creation of `thumbcache_605a.db` in `C:\Users\Public\` by any process. Separately, alert on a Windows service process reading `$Recycle.Bin` for `.doc`, `.docx`, `.pdf`, `.xls`, or `.xlsx` files, or spawning 7-Zip with a password argument.

   **Why it works:** The filename is hardcoded in the malware. Creation of this specific file by a non-indexing service process is a high-confidence signal. A service reading the Recycle Bin for document extensions has no legitimate administrative use case.

3. ### LSASS and SAM credential dumping

   **Telemetry:** EDR / process telemetry

   Alert on Mimikatz execution by hash, name, or behavioral signature, and on any process accessing LSASS with `PROCESS_VM_READ` rights. Alert on QuarksDumpLocalHash execution or any process reading the SAM registry hive outside of Windows backup or authentication services.

   **Why it works:** Credential dumping in Phase 1 is prerequisite to the Phase 2 exfiltration. These tools have no legitimate use on a government workstation and are individually high-confidence indicators of compromise.

4. ### New Windows service with an implausible-but-plausible name

   **Telemetry:** Service / Event ID 7045

   Monitor Event ID 7045, new service installed, and alert on services whose names match common Windows service names but are not present in the approved service baseline. Specifically alert on any service loading a DLL from `C:\Users\Public\` or `%TEMP%`.

   **Why it works:** Both ThumbcacheService and TmcLoader register as Windows services. Service names such as ThumbcacheService are designed to look like Windows thumbnail-cache management, but they are not legitimate Windows services. Event ID 7045 fires on every service creation and is not suppressed by the malware.

5. ### TmcPayload injected into svchost

   **Telemetry:** Process injection / memory telemetry

   Monitor for `svchost` process anomalies: memory regions not backed by a loaded module on disk, network connections established by `svchost` that do not match expected service DLLs for that instance, or `svchost` reading a GUID-named `.db` file from `C:\Users\Public\Libraries\`.

   **Why it works:** TmcPayload is injected into `svchost` in memory; no executable or DLL for TmcPayload appears on disk. Any `svchost` instance accessing the specific GUID-named configuration file is executing injected code. Cross-referencing with prior LSASS dump events establishes the two-phase timeline.

6. ### SMB authentication with mismatched credentials

   **Telemetry:** Authentication / network telemetry

   Alert on network-share access where the authenticating account differs from the currently logged-on user in the same session, particularly from a service process. On a government workstation, `svchost` authenticating to an internal SMB share using a specific named account should be compared against that account's normal access patterns.

   **Why it works:** TmcPayload uses credentials stolen in Phase 1 to authenticate to the network share in Phase 2. The process context, `svchost`, and the authenticating account will differ, which is anomalous and correlatable with the earlier LSASS dump event from the same host.

7. ### Go binary with base64 encrypted command-line arguments

   **Telemetry:** Process telemetry / command-line logging

   Alert on Go-compiled binaries executing with command-line arguments that are entirely base64-encoded strings exceeding 40 characters in length, particularly when the binary is not in a known application directory.

   **Why it works:** GoSerpent's encrypted argument passing is unusual; legitimate Go applications rarely receive their entire configuration as a single opaque base64 argument at runtime. This pattern is consistent across GoSerpent variants and survives recompilation that changes the binary hash.

Detections 01 through 04 fire during Phase 1: GoSerpent deployment, ThumbcacheService, and credential dumping. Detections 05 and 06 fire during Phase 2: TmcLoader/TmcPayload injection and SMB exfiltration. Phase 1 detection is preferable because exfiltration has not yet occurred. Catching either credential dumping or ThumbcacheService creation should trigger a full host investigation rather than a single-event response, because by the time those tools run, GoSerpent access is already established.

## Hardening and response recommendations

The GoSerpent campaign depends on unmonitored credential access, services without behavioral baselines, and the ability to use stolen credentials on internal network shares weeks after theft. The controls below target those dependencies. **Quick win** means a single configuration change deployable in days. **Standard** means a rollout or architectural change deployable in weeks.

1. ### Protect LSASS with Credential Guard and RunAsPPL

   **Priority:** Critical

   Credential Guard isolates LSASS secrets inside a virtualization-based security boundary, making them inaccessible to both Mimikatz-style memory reads and Go-based credential dumpers even when the attacker has local administrator access. Protected LSASS, RunAsPPL, requires a valid kernel driver signature to open LSASS for memory reading and blocks the `comsvcs.dll` MiniDump pattern.

   **Path:** Computer Configuration → Administrative Templates → System → Device Guard. Credential Guard requires TPM 2.0 and Secure Boot. Enable RunAsPPL through this registry key:

   `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1`

   If LSASS credentials cannot be dumped, the stolen credentials needed for Phase 2 network-share exfiltration cannot be obtained.

2. ### Monitor and baseline Windows services rigorously

   **Priority:** Quick win

   Every tool in the GoSerpent campaign except GoSerpent itself uses a Windows service for persistence or execution. Alerting on Event ID 7045 for any service not present in an approved baseline is one of the highest-fidelity controls available for this campaign, and it catches both ThumbcacheService and TmcLoader.

   **Do:** Build and maintain a service baseline for government endpoints. Forward Event ID 7045 to the SIEM and alert on any new service installation that does not match a change-management record. Services loading DLLs from user-writable directories, including Public, Temp, and AppData, warrant immediate investigation.

3. ### Apply process name and path verification for system processes

   **Priority:** Quick win

   GoSerpent masquerades as `lass.exe` and `updates.exe`. Detection requires knowing not just the process name but where it is running from. `lsass.exe` is only legitimate from `%SystemRoot%\System32\`. Any process with a similar name from any other path is masquerading.

   **Do:** Configure SIEM or EDR rules to alert on process image names that phonetically or visually resemble core Windows system processes, including `lsass`, `svchost`, `services`, `csrss`, and `winlogon`, but execute from non-system directories. This catches GoSerpent regardless of which specific name it uses.

4. ### Restrict and monitor access to `C:\Users\Public\`

   **Priority:** Standard

   ThumbcacheService stages its collection database and TmcPayload stores its configuration file in `C:\Users\Public\` and `C:\Users\Public\Libraries\` because these directories are world-writable without elevation. Monitoring file creation in these paths from service processes, and restricting executable and DLL loading from these directories, reduces the value of these staging locations.

   **Do:** Alert on creation of database files in `C:\Users\Public\` by non-user processes. Apply AppLocker or WDAC policies that prevent DLL loading from user-writable directories. This does not prevent the campaign but forces the operator to use a more detectable staging path.

5. ### Audit and restrict network-share access from service accounts

   **Priority:** Standard

   TmcPayload exfiltrates by using stolen credentials to authenticate to an internal network share. The transfer is indistinguishable from legitimate file access because the credentials are real. Detecting it requires logging what credentials are used to authenticate to shares and comparing that against expected access patterns.

   **Do:** Enable SMB audit logging, Object Access, Event IDs 5140 and 5145. Alert on share access authenticated by credentials that belong to an account different from the process owner. Implement least-privilege access to file shares so that a single compromised credential set has limited reach. Time-bound access tokens for internal shares reduce the window in which stolen credentials remain valid.

6. ### Respond: isolate, rotate credentials, correlate across the full timeline

   **Priority:** Quick win

   On suspected GoSerpent activity, isolate the affected endpoint before investigating to prevent further credential use. Preserve forensic artifacts before remediation: memory images, Windows Event Logs 4624, 4625, 7045, 4688, and 5140, and any files in `C:\Users\Public\`. Rotate all credentials accessible to the compromised host, including network-share credentials, not only the logged-on user account. Hunt for `thumbcache_605a.db` and the GUID-named configuration file as post-compromise indicators on all adjacent hosts.

   **Do:** Because GoSerpent is a two-phase campaign, investigating only the most recent event will miss the earlier phase. The LSASS dump and ThumbcacheService events may be weeks old by the time SMB exfiltration is detected. Extend log retention for government endpoints to cover at least 90 days and confirm that Event IDs 7045, 4688, and 5140 are being forwarded off-host before they can be cleared.

Controls 1 through 3 prevent or detect the credential theft and masquerading that enable the campaign. Controls 4 and 5 target the staging and exfiltration paths that make Phase 2 possible. Control 6 guides the investigation across both phases. None of these remove the need to understand the initial delivery mechanism, which remains publicly undisclosed for this campaign.

## Primary references

Source material this page is built on. All technical claims trace to the original security research first published in July 2026. MITRE ATT&CK provided the technique framework. Reviewed through August 2026.

- [The Hacker News: New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html) — Jul 2026
- [GBHackers: GoSerpent Silently Steals Government Files for Weeks Before Sending Them to Hackers](https://gbhackers.com/goserpent-steals-government-files/) — Jul 2026
- [CyberNews: GoSerpent malware spies on targets in Southeast Asia for months](https://cybernews.com/news/goserpent-malware-spies-southeast-asia/) — Jul 2026
- [TechRadar: Dangerous new GoSerpent malware is apparently on the hunt for government secrets](https://www.techradar.com/pro/security/dangerous-new-goserpent-malware-is-apparently-on-the-hunt-for-government-secrets) — Jul 2026
- [NewsBytes: GoSerpent cyber-espionage campaign targets Southeast Asian governments](https://newsbytes.ph/2026/07/27/goserpent-cyber-espionage-campaign-targets-se-asian-governments/) — Jul 2026
- [MITRE ATT&CK: Enterprise framework reference](https://attack.mitre.org/) — Current