GoSerpent Malware Targets Southeast Asian Governments

Kaspersky researchers identified a new malware, GoSerpent, which has been actively used in cyberattacks targeting government and diplomatic entities in Southeast Asia since late 2025. The discovery was made by Kaspersky's Global Research and Analysis Team in February 2026. GoSerpent is designed for long-term access and intelligence gathering, indicating a sophisticated espionage campaign.

The malware's primary objective appears to be the exfiltration of sensitive information from its targets. Analysis by Kaspersky suggests that GoSerpent employs advanced techniques to maintain persistence on compromised systems and evade detection by security software. The specific methods used for initial infection remain under investigation, but the campaign's duration and focus point to state-sponsored or highly organized threat actors.

While the exact origins of GoSerpent are not yet definitively confirmed, its operational characteristics and targeting profile align with the activities of advanced persistent threat (APT) groups. The malware's name, GoSerpent, is derived from the programming language it is written in, Go, and its serpentine ability to remain hidden and strike opportunistically. Kaspersky has not disclosed the specific countries targeted within Southeast Asia but emphasized the high-value nature of the compromised entities.

This discovery highlights the ongoing threat of cyber espionage in the region, with attackers continuously developing new tools and tactics to achieve their objectives. The prolonged nature of the GoSerpent campaign suggests a significant investment in resources by the perpetrators, aiming to establish a covert presence within targeted networks for an extended period. Further research is expected to reveal more about the malware's capabilities and the full scope of its operations.