Home / Technology / Malware Hides for 5 Years on Gov Systems
Malware Hides for 5 Years on Gov Systems
17 Jul
Summary
- GoSerpent malware evaded detection for five years.
- Attackers used extreme patience, deploying tools weeks apart.
- Campaign shows similarities to previous TetrisPhantom operations.
A stealthy cyber threat known as GoSerpent has been operating undetected for five years, compromising government computer systems in Southeast Asia. Security researchers at Kaspersky have detailed this long-running campaign, which utilizes a backdoor, a Remote Access Trojan named Stowaway, and a data exfiltration tool called TmcLoader.
The malware's long-term success is attributed to the attackers' extreme patience. They deliberately deploy initial backdoors and then wait for weeks before activating secondary tools like TmcLoader. This tactic is designed to bypass automated security sweeps and outlast standard log retention periods, making it exceptionally challenging for security teams to link initial infections to subsequent data theft.
While definitive attribution remains elusive, the campaign exhibits notable similarities to previous operations conducted by the TetrisPhantom actor. These overlaps include the types of victims targeted, the technical methods employed, and the operational strategies. Kaspersky previously investigated TetrisPhantom in 2023, noting its compromise of secure USB drives used for data encryption among government entities in the Asia-Pacific region.
