Kaspersky has disclosed a cyber-espionage campaign, dubbed GoSerpent, that targeted government and diplomatic organisations in Southeast Asia using a previously undocumented remote access trojan (RAT).
According to researchers from Kaspersky’s Global Research and Analysis Team (GReAT), the campaign relies on a collection of customised malware, including the GoSerpent backdoor, Stowaway and TmcLoader, to establish long-term access and exfiltrate sensitive information.
The company said the GoSerpent malware is a Go-based remote access trojan that has reportedly been active since at least 2021, with the latest known variant observed in 2026. The malware incorporates persistence mechanisms and disguises itself using filenames that resemble legitimate system processes to reduce the likelihood of detection.
Kaspersky also said it is investigating possible links between the GoSerpent campaign and the threat actor known as TetrisPhantom, citing similarities in targeting patterns, technical capabilities and operational methods. However, the company noted that attribution remains under investigation.