MalwareUsed by 1 actor

GoSerpent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TetrisPhantom

During the attack, the main malware, dubbed GoSerpent, received an encrypted argument and started communication with a remote server. It was also used to deploy further malicious tools for sensitive data collection and credential dumping on the system.

via malware newsmalware.news

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

This malware receives encrypted and base64-encoded command-line arguments... ThumbcacheService employs XOR encryption... TmcLoader employs dynamic API resolution through a circular XOR encryption... combined with Base64 encoding for string obfuscation.

T1036MasqueradingEvidence2

The malware exhibits strong persistence mechanisms and uses filenames that mimic legitimate system processes such as lass.exe and updates.exe to evade detection.

Credential Access

1 technique

T1003OS Credential DumpingEvidence2

The threat actor deploys the following tools via GoSerpent backdoor to dump credentials: Mimikatz — dumps memory from the LSASS process... QuarksDumpLocalHash — extracts local account password hashes from the SAM registry hive.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

The backdoor connects to command-and-control servers using ChaCha20 encryption for communications... Communications are transported over TCP, HTTP, or WebSocket channels with protection using AES-256-GCM or TLS encryption.

T1090ProxyEvidence1

GoSerpent can establish SOCKS5 proxy servers to route traffic through compromised hosts... Stowaway... enabling attackers to establish chained proxy paths across multiple hosts with the following functionalities: SOCKS5 proxying port forwarding reverse tunneling

T1090.003Multi-hop ProxyEvidence1

GoSerpent can establish SOCKS5 proxy servers to route traffic through compromised hosts, enabling attackers to access other networks while masking their true IP addresses.

T1095Non-Application Layer ProtocolEvidence1

The backdoor connects to command-and-control servers using ChaCha20 encryption for communications... Communications are transported over TCP...

T1105Ingress Tool TransferEvidence2

Following initial deployment of the GoSerpent backdoor, attackers typically wait several days before utilizing it to download and execute additional malware components for data collection and credential dumping.

T1219Remote Access ToolsEvidence2

The primary weapon in this campaign is the GoSerpent backdoor... Stowaway is a proxy and remote access tool... McMx is a basic Go-based proxy and remote access tool.

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 16, 2026

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - Malware News - Malware Analysis, News and Indicators

A Go-based remote access trojan/backdoor with proxy capabilities that communicates with C2 using ChaCha20-encrypted traffic, accepts encrypted command-line arguments, supports remote shell, file transfer, port forwarding, and SOCKS5 proxying, and deploys follow-on tools for collection and credential dumping.

securelistNews

Jun 11, 2026

GoSerpent backdoor attacks in Southeast Asia | Securelist

Go-based backdoor/RAT with proxy capabilities that receives encrypted command-line arguments, communicates with C2 using ChaCha20, supports remote shell, file upload/download, port forwarding, and SOCKS5 proxying, and is used to deploy follow-on tools for file collection and credential dumping.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

GoSerpent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TetrisPhantom

via malware newsmalware.news

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

T1036MasqueradingEvidence2

The malware exhibits strong persistence mechanisms and uses filenames that mimic legitimate system processes such as lass.exe and updates.exe to evade detection.

Credential Access

1 technique

T1003OS Credential DumpingEvidence2

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

T1090ProxyEvidence1

T1090.003Multi-hop ProxyEvidence1

GoSerpent can establish SOCKS5 proxy servers to route traffic through compromised hosts, enabling attackers to access other networks while masking their true IP addresses.

T1095Non-Application Layer ProtocolEvidence1

The backdoor connects to command-and-control servers using ChaCha20 encryption for communications... Communications are transported over TCP...

T1105Ingress Tool TransferEvidence2

T1219Remote Access ToolsEvidence2

The primary weapon in this campaign is the GoSerpent backdoor... Stowaway is a proxy and remote access tool... McMx is a basic Go-based proxy and remote access tool.

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 16, 2026

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - Malware News - Malware Analysis, News and Indicators

securelistNews

Jun 11, 2026

GoSerpent backdoor attacks in Southeast Asia | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.