GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration

Key Takeaways

• Introduction In February 2026, we discovered a set of malicious activities that had been ongoing since late 2025.
• These activities involved a RAT module written in Go with proxy capabilities, which served as the main stage of the attack.
• The attack targeted government and diplomatic entities in Southeast Asia and showed a level of sophistication that caught our attention.