Loading story…
A long-running espionage campaign targeted government and diplomatic entities in Southeast Asia using GoSerpent, a Go-based backdoor that researchers say has been active since late 2025, with earlier variants seen against regional victims as far back as 2021. The malware established persistence as a Windows service and used stealth features including encrypted arguments, obfuscated strings, and payload execution inside svchost, while command-and-control infrastructure was hosted through legitimate providers to blend in with normal traffic.
The operators used GoSerpent to deploy follow-on tooling for file collection, credential dumping, proxying, and data theft, and later returned with an expanded toolkit that included Stowaway and the TmcLoader/TmcPayload exfiltration chain. Researchers said the activity showed deliberate coordination across intrusion stages, from initial backdoor access through credential theft and staged exfiltration, and noted a possible but unconfirmed connection to the TetrisPhantom threat actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In May 2026, the operators returned with an updated toolkit that included Stowaway and the TmcLoader/TmcPayload exfiltration chain. The change showed deliberate coordination between collection, credential theft, and data exfiltration components.
The campaign was discovered in February 2026, according to the report. Researchers identified GoSerpent being used alongside tools for file collection, credential dumping, proxying, and later-stage exfiltration.
A sophisticated espionage campaign targeting government and diplomatic entities in Southeast Asia was active since late 2025. The operation centered on a Go-based backdoor called GoSerpent and supporting tooling for collection and credential theft.
The report says earlier variants of the GoSerpent backdoor were used against victims in Southeast Asia as far back as 2021. This is presented as prior activity related to the malware family discussed in the campaign.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that the **Gamaredon** threat group conducted at least four campaigns from 2020 onward, combining nation-state espionage objectives with high-volume, crimeware-like delivery methods. The operations used **template injection**, trojanized installers, self-extracting archives, spam, and scripts including **VBS**, **VBA**, and batch files to gain initial access and profile victims before selectively deploying second-stage payloads. Talos said the group operated more than **600 first-stage C2 domains** and over **330 IP addresses across 16 countries**, with infrastructure heavily concentrated in Russia. The campaigns showed a strong focus on **Ukrainian targets**, including Russian-language lures themed around Ukrainian government entities, while also reaching organizations outside Ukraine such as a major African bank, U.S. educational institutions, and European telecommunications and hosting providers. Talos highlighted examples including a trojanized **Zoom** installer, an unusually large **68 MB VBS** file likely designed to evade sandbox analysis, and a long-running operation that excluded more than **1,700 IP addresses in 43 countries** from infection. Researchers assessed Gamaredon as a prolific, noisy, likely second-tier APT focused on espionage and information collection rather than direct monetization.
Jun 29, 2026
The **SideWinder** espionage group, also tracked as **RagaSerpent** and suspected to be India-linked, has expanded targeted operations across Southeast Asia, including **Thailand** and **Indonesia**, with victims spanning government, telecommunications, critical infrastructure, maritime, logistics, and nuclear-sector organizations. Reporting indicates the campaign remains focused on intelligence collection and long-term access rather than disruption, with operators using spear-phishing, stolen credentials, older Microsoft Office vulnerabilities, and DLL hijacking to gain entry into victim environments. Researchers said the group offsets these relatively simple intrusion methods with disciplined post-compromise tradecraft, including staged payload delivery, persistence through Windows services, and rapidly rotating command-and-control infrastructure. A notable feature of recent activity is malware that derives its C2 configuration dynamically at runtime, allowing operators to shift infrastructure without rebuilding payloads and complicating remediation. Separate reporting also links **RagaSerpent** to a multi-country targeted intrusion chain described as a SideWinder-adjacent **"Tax Audit"** cluster, reinforcing concerns that the threat actor is sustaining broad regional espionage activity and pre-positioning inside networks for strategic access.
Jun 29, 2026
The likely nation-state-backed **Harvester** group has expanded its espionage operations in South Asia with a new Linux variant of its `GoGra` backdoor, extending a toolset previously associated with Windows intrusions. Researchers linked the malware to Harvester through near-identical code, shared command-and-control logic, and matching spelling errors, and said the backdoor uses the **Microsoft Graph API** and Outlook mailboxes as a covert C2 channel to blend malicious traffic with legitimate cloud activity. Initial submissions tied to the malware came from **India** and **Afghanistan**, and the use of localized decoy documents indicates a tailored campaign against regional targets. Harvester has been active since at least 2021 and was previously observed targeting **telecommunications, government, and IT organizations**, particularly in Afghanistan, with custom malware including **Backdoor.Graphon**, a downloader, and a screenshot utility, alongside **Cobalt Strike Beacon** and **Metasploit**. In both earlier and newer activity, the group abused legitimate Microsoft infrastructure to evade perimeter defenses; the Linux `GoGra` sample persists through a `systemd` user service and an XDG autostart entry, then executes commands delivered through encrypted email messages. The campaign shows Harvester building a cross-platform espionage capability while maintaining a consistent focus on South Asian victims.
Jun 29, 2026