GoSerpent Campaign Deploys Persistent Go‑Based RAT and Credential‑Dumping Tools Against Southeast Asian Government Entities
What Happened — Kaspersky’s SecureList details a multi‑stage intrusion campaign that has been active since late 2025. The threat actor uses a Go‑written backdoor (GoSerpent) to install additional RATs, credential‑dumping utilities and a custom “ThumbcacheService” data‑collector, then exfiltrates files via network shares. A newer variant appeared in May 2026 with an upgraded Stowaway RAT and proxy tool, but the older, simpler version continues to be deployed in parallel.
Why It Matters for Compliance & Audit Readiness
- The attack illustrates a classic failure of access‑control hygiene: privileged credentials are harvested and used to move laterally and exfiltrate data. SOC 2 CC6.1 (Logical Access) requires documented controls, periodic review of privileged accounts, and evidence of enforcement.
- Continuous monitoring of remote‑access tools and anomalous credential‑dumping activity provides the audit evidence needed to demonstrate “effective implementation” of the Access Control criteria.
- Verisq’s SOC 2 Access‑Controls capability can automate collection of logs, flag suspicious credential‑dumping behavior, and generate ready‑to‑use evidence for auditors.
Who Is Affected — Government ministries, diplomatic missions, and related agencies in Southeast Asia; any organization that grants privileged access to remote administration tools.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC6.2 (User Management) controls; verify that privileged accounts are limited, reviewed quarterly, and protected with MFA.
- Deploy continuous‑monitoring solutions that capture process creation, credential‑dumping tool execution, and outbound C2 traffic; retain logs for audit‑ready evidence.
- Conduct targeted security‑awareness training for administrators on the risks of unsanctioned remote‑access utilities and the signs of credential‑dumping activity.
Source: SecureList – GoSerpent Backdoor in Southeast Asia
Technical Notes
- GoSerpent receives encrypted, base64‑encoded arguments; decryption uses AES‑CBC with a static IV (
31323334353637383930616263646566). - Secondary tools include McMx RAT, Stowaway RAT, TmcLoader/TmcPayload, and the ThumbcacheService collector.
- Credential‑dumping utilities leverage standard Windows APIs (e.g., LSASS memory extraction).
- Exfiltration is performed over SMB network shares to attacker‑controlled servers.