GoSerpent: A New Espionage Tool Quietly Targeting Southeast Asian Governments

Key points

• Kaspersky disclosed a previously undocumented malware family called GoSerpent in February 2026, tracking attacks that began in late 2025.
• The campaign targets government and diplomatic organisations in Southeast Asia, according to Kaspersky's telemetry.
• Operators appear focused on persistent, quiet access rather than immediate disruption.
• Public attribution to a specific state-linked group has not been made, and no vendor cluster name has been assigned.
• Affected sectors handle sensitive diplomatic communications, which raises the cost of any successful intrusion.

Researchers at Kaspersky say they've found a new piece of spying software they're calling GoSerpent, and it has been quietly used against government offices and embassies in Southeast Asia since late 2025.

Kaspersky, the Russian security company, disclosed the activity in February 2026. GoSerpent is a previously undocumented malware family, meaning no vendor had published on it before. It's malicious software: a program installed on a victim's machine without permission, designed to give attackers a foothold inside the network. The Hacker News also picked up the reporting.

That foothold is the point. Kaspersky's account frames the goal as long-term access and intelligence gathering, not a quick smash-and-grab.

Who is behind GoSerpent?

Nobody has said, at least not on the record. Kaspersky hasn't tied the malware to a named group such as Mustang Panda or other China-nexus clusters that habitually work Southeast Asian diplomatic targets. No shorthand cluster label has appeared in public reporting.

That matters. Attribution in this part of the world is crowded. Several state-linked groups, tracked under different labels by competing vendors, share overlapping targeting and sometimes overlapping tooling. Without indicators of compromise, the technical fingerprints such as file hashes or server addresses that let defenders match one intrusion to another, it's too early to say who is running this operation.

Kaspersky's account does support, at medium confidence based on the described behaviour, one conclusion: intent. The malware is built for persistence and quiet collection. That profile fits espionage, not cybercrime.

Worth noting too is that Kaspersky's ToddyCat reporting on 2 July and our earlier coverage of a China-linked backdoor against Southeast Asian utilities on 3 July show how congested this targeting space has become. GoSerpent may be one more thread in that picture, or an entirely separate one.

What does the malware actually do?

GoSerpent is designed to sit on a compromised machine and stay there. Get in through a phishing email or an unpatched server. Install a quiet backdoor, a hidden channel the attackers can use whenever they like. Then wait and copy documents out slowly enough to avoid tripping alarms.

Capability is one thing; intent is another. The victims here, diplomats and government staff, tell you what the operators are after: cables, negotiating positions, personal contacts.

Should ordinary people be worried?

Not directly. This isn't a consumer campaign and nobody's online banking is at risk from GoSerpent.

But the wider point is worth holding. Diplomatic networks carry information that shapes trade deals and security pacts. When a foreign intelligence service reads that traffic for months, the effects reach citizens who never touched a compromised laptop.

For defenders in the region, the practical action is unglamorous. Hunt for unusual outbound traffic. Check mail gateways for spear-phishing, targeted fake emails written to deceive a specific person. Patch internet-facing servers. Assume that more indicators will follow from Kaspersky and other vendors in the coming weeks as GoSerpent samples are triaged.

Until then, treat single-source reporting as exactly that: one vendor, one telemetry set, one early read.