GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration

What Happened

A sophisticated hacking group has been targeting government and diplomatic organizations in Southeast Asia since at least 2021 using a malware tool called GoSerpent. The attackers use a multi-step approach: first they install a backdoor (a hidden remote access tool) that lets them control infected computers, then they deploy additional tools to silently collect sensitive documents (like Word, Excel, and PDF files) over weeks or months. They also steal computer passwords to help them move data out later. In a second phase months later, they return with new tools to quietly transfer all the collected files out of the victim's network using the stolen passwords. Government and diplomatic organizations in Southeast Asia are the primary targets. Organizations in the region should check their systems for the specific files, network connections, and malware indicators described in the report, and ensure they have strong monitoring for unusual network share access and unexpected Windows services.

Key Takeaways

• GoSerpent is a Go-based RAT active since 2021 targeting government and diplomatic entities in Southeast Asia, with evolved variants deployed through 2026
• The threat actor integrates multiple tools in a coordinated chain: GoSerpent deploys ThumbcacheService for file collection and credential dumpers, then later deploys Stowaway and TmcLoader/TmcPayload to exfiltrate the collected data via network shares
• ThumbcacheService specifically targets .doc, .docx, .pdf, .xls, and .xlsx files, archives them with 7-Zip using a hardcoded password, and stores them in C:\Users\Public\thumbcache_605a.db
• TmcPayload injects into the svchost process and exfiltrates the exact thumbcache_605a.db file using credentials harvested earlier, demonstrating tight toolset integration
• Possible attribution link to TetrisPhantom threat actor based on victim targeting and operational methodology similarities

Affected Systems

• Windows systems in government and diplomatic organizations in Southeast Asia

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: GoSerpent backdoor deployed with encrypted C2 parameters on target government/diplomatic systems in Southeast Asia
2. Persistence & Collection: GoSerpent deploys ThumbcacheService as a Windows service to silently collect .doc/.docx/.pdf/.xls/.xlsx files into thumbcache_605a.db over weeks
3. Credential Dumping: GoSerpent deploys Mimikatz and QuarksDumpLocalHash to extract LSASS credentials and SAM hashes for later use
4. Second Stage: Stowaway RAT deployed months later to establish chained proxy paths and deliver TmcLoader with encrypted configuration file
5. Exfiltration: TmcLoader injects TmcPayload into svchost process; TmcPayload reads configuration with stolen network share credentials and exfiltrates thumbcache_605a.db via network shares

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not include any detection rules, queries, or signatures. It provides IOCs (file hashes and C2 IP addresses) and technical behavioral descriptions that could be used to develop custom detections.

Detection Engineering Assessment

Required Log Sources

• Windows Event Logs (Service creation - Event ID 7045, 4697)
• Sysmon Event ID 1 (Process Creation), 7 (Image Loaded), 8 (Remote Thread Creation), 11 (File Creation)
• EDR process telemetry including command-line arguments
• Network flow logs for C2 beaconing and SOCKS5 proxy detection
• Windows Event Log 4624 (logon events) and 5140/5145 (network share access) for exfiltration detection
• File system monitoring for C:\Users\Public\ directory writes

Hunting Hypotheses

Control Gaps

• Network-based detection may miss C2 traffic that uses legitimate hosting providers and standard protocols (HTTP, WebSocket) with encryption
• File collection by ThumbcacheService may not trigger alerts if the targeted file types (.doc, .docx, .pdf, .xls, .xlsx) are accessed during normal business hours
• Process injection into svchost by TmcPayload may evade application whitelisting and some behavioral detection rules
• The multi-month delay between collection and exfiltration may exceed typical detection correlation windows, breaking kill-chain analysis

Key Behavioral Indicators

• Windows service creation with names containing 'Thumbcache' or 'Tmc' from non-standard paths
• File writes to C:\Users\Public\ creating .db files or GUID-named files in Libraries subdirectory
• Processes named lass.exe (not lsass.exe) or updates.exe in non-standard directories exhibiting network activity
• 7-Zip archiving of document files with password protection from a service context
• Monitoring of $Recycle.Bin directory by a Windows service process
• SOCKS5 proxy listeners on workstations communicating with cloud hosting provider IP ranges
• Network share access using credentials that were recently dumped on the accessing host

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether network segmentation can restrict workstation-to-workstation SOCKS5 proxy traffic and limit lateral movement via network shares.
• Consider implementing network flow monitoring for outbound connections to Alibaba Cloud and UCLOUD HK IP ranges if these are not part of normal business traffic.
• If applicable, consider enforcing LSA Protection (RunAsPPL) and Credential Guard to mitigate Mimikatz-based LSASS credential dumping.
• Consider restricting write permissions to C:\Users\Public\ via AppLocker or similar application control policies.

User Protection

• Consider deploying EDR behavioral detection rules for process injection into svchost.exe from non-standard parent processes.
• Evaluate whether your endpoint protection can detect XOR-obfuscated strings in DLLs loaded as Windows services.
• Consider enabling Sysmon logging for file creation in C:\Users\Public\ and its subdirectories if not already covered.
• If supported by your tooling, consider alerting on any process named lass.exe (misspelling of lsass.exe) or updates.exe running from non-standard paths.

Security Awareness

• Consider reminding staff in government and diplomatic roles about the importance of reporting unusual system behavior, especially unexpected service installations or slow system performance during file collection.
• If applicable to your awareness program, consider highlighting that attackers may use legitimate-looking filenames and services to evade detection, emphasizing the importance of verifying unexpected system changes with IT security teams.

MITRE ATT&CK Mapping

Additional IOCs

• Ips:
  • 8[.]220[.]209[.]155 - C2 IP address used by campaign infrastructure
  • 8[.]220[.]193[.]189 - C2 IP address used by campaign infrastructure
  • 144[.]48[.]6[.]46 - C2 IP address used by campaign infrastructure
  • 47[.]80[.]22[.]58 - C2 IP address used by campaign infrastructure
  • 152[.]32[.]222[.]113 - C2 IP address used by campaign infrastructure
  • 43[.]106[.]30[.]226 - C2 IP address used by campaign infrastructure
• File Hashes:
  • DC506FF7BB72735444FB3703A6BEE6D8 (MD5) - MD5 hash of GoSerpent backdoor binary (second sample)
  • D6E86BF8A90E9B632ADD5FA495F97FBC (MD5) - MD5 hash of McMx RAT, simpler Go-based variant of GoSerpent
  • 64E9D1950E42BC98486DFD9919463D1C (MD5) - MD5 hash of ThumbcacheService malicious DLL (second sample)
  • 7F223EE0716CE2AD56F55D3744419449 (MD5) - MD5 hash of Stowaway RAT/proxy tool binary (second sample)
  • 19F8BEFCB035F52BF70094E6B4F5779A (MD5) - MD5 hash of Stowaway RAT/proxy tool binary (third sample)
  • 846EF7C1C7323849B2A778C5E4CDA162 (MD5) - MD5 hash of Stowaway RAT/proxy tool binary (fourth sample)
  • 93A1569D5D5AB2C4761FEDF84F83709E (MD5) - MD5 hash of TmcLoader stealthy C++ loader (second sample)
• File Paths:
  • C:\Users\Public\thumbcache_605a.db - Database file created by ThumbcacheService to store collected sensitive documents
  • C:\Users\Public\Libraries\{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db - Encrypted configuration file delivered via Stowaway containing network share credentials and exfiltration destination paths
• Command Lines:
  • Purpose: GoSerpent receives encrypted base64-encoded command-line arguments containing C2 server address and communication password, decrypted via AES-CBC | Tools: GoSerpent | Stage: Initial Access / C2 Establishment
  • Purpose: McMx configuration generated via batch file echo commands writing C2 parameters to text file | Tools: cmd.exe, McMx | Stage: C2 Configuration | echo <c2_params> > <config_file>
• Other:
  • lass.exe - Filename used by GoSerpent to mimic legitimate Windows process lsass.exe for evasion
  • updates.exe - Filename used by GoSerpent to mimic a legitimate update process for evasion
  • 31323334353637383930616263646566 - Fixed AES-CBC IV used by GoSerpent for decrypting command-line arguments
  • @vx0a9n5W2M0c3D6.# - Hardcoded 7-Zip archive password used by ThumbcacheService to protect collected file archives
  • 0x13 - Single-byte XOR key used by ThumbcacheService for string obfuscation