GoSerpent Campaign Uses Staged Tools for Data Collection and Exfiltration in Southeast Asia
Summary
Researchers describe GoSerpent activity targeting Southeast Asian government and diplomatic entities, using RATs, credential-dumping and file-collection tools, then Stowaway and TmcLoader/TmcPayload for configured network-share exfiltration. A possible TetrisPhantom tie
Key points
- Researchers describe activity ongoing since late 2025 targeting government and diplomatic entities in Southeast Asia; earlier GoSerpent versions were reportedly used in the region since 2021.
- GoSerpent uses encrypted, base64-encoded command-line arguments and ChaCha20-protected C2 communications, and supports SOCKS5 proxying, remote shell access and file transfer.
- ThumbcacheService collects selected documents, archives them in thumbcache_605a.db and monitors the Recycle Bin; Mimikatz and QuarksDumpLocalHash are used to obtain credentials and password hashes.
- In May 2026, the actors returned with Stowaway and the TmcLoader/TmcPayload chain. TmcPayload uses configuration containing network-share credentials and paths to transfer the staged database file.
- The operators used legitimate hosting providers and domain names as secret keys, which the researchers say can make detection more challenging.
- Researchers assess a possible connection to TetrisPhantom based on similarities in targeting, technical capabilities and methods, but say attribution remains uncertain.
Article Details
- Attack Vectors
- GoSerpent receives encrypted, Base64-encoded command-line arguments containing C2 details and uses ChaCha20-protected C2 communications.
- GoSerpent and McMx provide SOCKS5 proxying, port forwarding, file transfer, and remote-shell capabilities; GoSerpent can route traffic through compromised hosts.
- Attackers used GoSerpent to deploy ThumbcacheService for file collection and Mimikatz and QuarksDumpLocalHash for credential dumping.
- ThumbcacheService collects selected document types and deleted files, archives them with 7-Zip, and stores them in thumbcache_605a.db for later theft.
- Attackers manipulated batch files and used echo commands to create McMx configuration files containing C2 parameters.
- In May 2026, Stowaway delivered TmcLoader and an encrypted configuration file; TmcPayload used configured network-share credentials and destinations to exfiltrate thumbcache_605a.db.
- Defensive Notes
- The article identifies Windows-service registration by ThumbcacheService and TmcLoader, and the filenames lass.exe and updates.exe, as behaviors or names relevant to detection.
- Other described artifacts and behaviors include thumbcache_605a.db, SOCKS5 proxy activity, and Stowaway communications over HTTP or WebSocket.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 101[.]36[.]104[.]87 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 103[.]138[.]13[.]30 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 144[.]48[.]6[.]46 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 152[.]32[.]160[.]239 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 152[.]32[.]222[.]113 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 43[.]106[.]30[.]226 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 47[.]80[.]22[.]58 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 8[.]220[.]193[.]189 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 8[.]220[.]194[.]108 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 8[.]220[.]209[.]155 | Listed as C2 infrastructure for the campaign. |
| IPV4 | 8[.]220[.]214[.]132 | Listed as C2 infrastructure for the campaign. |
| MD5 | 19f8befcb035f52bf70094e6b4f5779a | File hash identified as a Stowaway malware sample. |
| MD5 | 64e9d1950e42bc98486dfd9919463d1c | File hash identified as a ThumbcacheService malware sample. |
| MD5 | 7f223ee0716ce2ad56f55d3744419449 | File hash identified as a Stowaway malware sample. |
| MD5 | 846ef7c1c7323849b2a778c5e4cda162 | File hash identified as a Stowaway malware sample. |
| MD5 | 93a1569d5d5ab2c4761fedf84f83709e | File hash identified as a TmcLoader malware sample. |
| MD5 | cb6c4c70a3b171fa3404b8e1a3382116 | File hash identified as a ThumbcacheService malware sample. |
| MD5 | cbbb6d483737ea3566726e51752dff40 | File hash identified as a Stowaway malware sample. |
| MD5 | d08a059e8b815e3b891505bc8777fc28 | File hash identified as a TmcLoader malware sample. |
| MD5 | d6e86bf8a90e9b632add5fa495f97fbc | File hash identified as a McMx malware sample. |
| SHA256 | ebffd5a76aaa690bcdb922f82e0bacc5dc506ff7bb72735444fb3703a6bee6d8 | File hash identified as a GoSerpent malware sample. |
MITRE ATT&CK
T1003.001 · LSASS MemoryMimikatz dumped LSASS memory to obtain credential material.T1003.002 · Security Account ManagerQuarksDumpLocalHash extracted local account password hashes from the SAM registry hive.T1005 · Data from Local SystemThumbcacheService collected sensitive documents and deleted files from the local system.T1027 · Obfuscated Files or InformationThe malware used encryption, Base64 encoding, and XOR obfuscation for arguments, configurations, and strings.T1036.005 · Match Legitimate Resource Name or LocationGoSerpent used filenames such as lass.exe and updates.exe that mimic legitimate system processes.T1059.003 · Windows Command ShellAttackers manipulated batch files and used echo commands to create McMx configuration files.T1071.001 · Web ProtocolsStowaway communications can use HTTP channels.T1074.001 · Local Data StagingThumbcacheService stored collected files in thumbcache_605a.db for later exfiltration.T1090 · ProxyGoSerpent, McMx, and Stowaway provide proxy capabilities that operators used to route traffic through compromised hosts.T1090.001 · Internal ProxyGoSerpent can start a SOCKS5 proxy on an infected machine and forward traffic to a connected node.T1090.003 · Multi-hop ProxyStowaway supports chained proxy paths across multiple hosts.T1105 · Ingress Tool TransferGoSerpent downloaded and executed additional tools, and Stowaway delivered TmcLoader and its configuration file to victim machines.T1543.003 · Windows ServiceThumbcacheService and TmcLoader were registered as Windows services.T1560.001 · Archive via UtilityThumbcacheService used 7-Zip to archive targeted files.
Threat Actors
Malware
GoSerpentThe GoSerpent campaign used Go-based RATs, proxy tools, and staged loaders to target government and diplomatic entities in Southeast Asia for long-term access, credential theft, and sensitive data exfiltration.McMxIn 2026, the threat actors evolved from GoSerpent and McMx to Stowaway and TmcLoader/TmcPayload, with the activity potentially linked to TetrisPhantom.StowawayIn 2026, the threat actors evolved from GoSerpent and McMx to Stowaway and TmcLoader/TmcPayload, with the activity potentially linked to TetrisPhantom.ThumbcacheService#GoSerpentTmcLoaderIn 2026, the threat actors evolved from GoSerpent and McMx to Stowaway and TmcLoader/TmcPayload, with the activity potentially linked to TetrisPhantom.TmcPayloadIn 2026, the threat actors evolved from GoSerpent and McMx to Stowaway and TmcLoader/TmcPayload, with the activity potentially linked to TetrisPhantom.
Vendors
Alibaba CloudThe malware operators leverage legitimate hosting providers including Alibaba Cloud and UCLOUD HK for their command-and-control infrastructure. The use of legitimate hosting platforms demonstrates operational securityUCLOUD HKThe malware operators leverage legitimate hosting providers including Alibaba Cloud and UCLOUD HK for their command-and-control infrastructure. The use of legitimate hosting platforms demonstrates operational security
Products
Tools
MimikatzThe attackers used GoSerpent to deploy ThumbcacheService for file collection and credential dumping tools such as Mimikatz and QuarksDumpLocalHash.QuarksDumpLocalHashThe attackers used GoSerpent to deploy ThumbcacheService for file collection and credential dumping tools such as Mimikatz and QuarksDumpLocalHash.
Industries
Diplomatic entitiesThe GoSerpent campaign used Go-based RATs, proxy tools, and staged loaders to target government and diplomatic entities in Southeast Asia for long-term access, credential theft, and sensitive data exfiltration.GovernmentThe GoSerpent campaign used Go-based RATs, proxy tools, and staged loaders to target government and diplomatic entities in Southeast Asia for long-term access, credential theft, and sensitive data exfiltration.