THREAT OPS › Threat News › GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/07/16074922/goserpent-featured-image-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>In February 2026, we discovered a set of malicious activities that had been ongoing since late 2025. Th
MITRE ATT&CK techniques
Indicators of compromise
- 31323334353637383930616263646566md5
- ebffd5a76aaa690bcdb922f82e0bacc5md5
- dc506ff7bb72735444fb3703a6bee6d8md5
- d6e86bf8a90e9b632add5fa495f97fbcmd5
- cb6c4c70a3b171fa3404b8e1a3382116md5
- 64e9d1950e42bc98486dfd9919463d1cmd5
- cbbb6d483737ea3566726e51752dff40md5
- 7f223ee0716ce2ad56f55d3744419449md5
- 19f8befcb035f52bf70094e6b4f5779amd5
- 846ef7c1c7323849b2a778c5e4cda162md5
- d08a059e8b815e3b891505bc8777fc28md5
- 93a1569d5d5ab2c4761fedf84f83709emd5
- https://opentip.kaspersky.com/ebffd5a76aaa690bcdb922f82e0bacc5/results?icid=gl_sl_post-opentip_sm-team_936a79b90e03a3a0&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/dc506ff7bb72735444fb3703a6bee6d8/results?icid=gl_sl_post-opentip_sm-team_358c32ea3881f702&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/d6e86bf8a90e9b632add5fa495f97fbc/results?icid=gl_sl_post-opentip_sm-team_86fc0ce47eeb774e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/cb6c4c70a3b171fa3404b8e1a3382116/results?icid=gl_sl_post-opentip_sm-team_5122aee562d864f3&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/64e9d1950e42bc98486dfd9919463d1c/results?icid=gl_sl_post-opentip_sm-team_57aed57c0f93b815&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/cbbb6d483737ea3566726e51752dff40/results?icid=gl_sl_post-opentip_sm-team_3d53c03a285e44f4&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/7f223ee0716ce2ad56f55d3744419449/results?icid=gl_sl_post-opentip_sm-team_75ff9d7b37e79ffd&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/19f8befcb035f52bf70094e6b4f5779a/results?icid=gl_sl_post-opentip_sm-team_8523537c4b1e3933&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/846ef7c1c7323849b2a778c5e4cda162/results?icid=gl_sl_post-opentip_sm-team_f792a0cd7acd5c9e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/d08a059e8b815e3b891505bc8777fc28/results?icid=gl_sl_post-opentip_sm-team_133814420e8b2d82&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/93a1569d5d5ab2c4761fedf84f83709e/results?icid=gl_sl_post-opentip_sm-team_b11d56451311d425&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/152.32.160.239/?icid=gl_sl_post-opentip_sm-team_d81a8de0e31afe66&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8.220.194.108/?icid=gl_sl_post-opentip_sm-team_dcc4871402bcb59e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8.220.214.132/?icid=gl_sl_post-opentip_sm-team_930196b58cd18a4a&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8.220.209.155/?icid=gl_sl_post-opentip_sm-team_ce9f823e445fbc73&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8.220.193.189/?icid=gl_sl_post-opentip_sm-team_87e656d22324b46c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/101.36.104.87/?icid=gl_sl_post-opentip_sm-team_bbf51ecf15c93252&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/144.48.6.46/?icid=gl_sl_post-opentip_sm-team_65b935e1d5f46b02&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/103.138.13.30/?icid=gl_sl_post-opentip_sm-team_36fbbd830c5bc0a5&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/47.80.22.58/?icid=gl_sl_post-opentip_sm-team_8b483db48040fdf2&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/152.32.222.113/?icid=gl_sl_post-opentip_sm-team_9278941e2f07b074&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/43.106.30.226/?icid=gl_sl_post-opentip_sm-team_478dfaebf13e5615&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- 152.32.160.239ipv4
- 8.220.194.108ipv4
- 8.220.214.132ipv4
- 8.220.209.155ipv4
- 8.220.193.189ipv4
- 101.36.104.87ipv4
Original source: https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/