In July 2026, researchers from Kaspersky's Global Research and Analysis Team (GReAT) identified a new cyber-espionage campaign dubbed GoSerpent, describing it as a sophisticated and adaptive operation focused on collecting and exfiltrating sensitive data.

According to the researchers, the campaign relies on a set of customised tools, including the GoSerpent backdoor, Stowaway and TmcLoader, reflecting a high level of technical capability and operational planning.

A key component of the campaign is the GoSerpent backdoor, a Go-based remote access trojan (RAT) that has reportedly been active since at least 2021, with the latest known variant deployed in 2026. The malware uses strong persistence mechanisms and filenames that mimic legitimate system processes to reduce the likelihood of detection.

"What stands out about GoSerpent is the deliberate dwell time. Usually, attackers want to move quickly once they gain a foothold, but this group installs the initial backdoor and waits. They let the dust settle for weeks before deploying secondary exfiltration tools such as TmcLoader. That patience is a calculated strategy designed to outlast standard log retention policies and automated security scans, making it much harder for defenders to link the initial compromise to the eventual data theft," said Noushin Shabab, Lead Security Researcher at Kaspersky GReAT.

Kaspersky researchers suspect a link between the GoSerpent campaign and the TetrisPhantom threat actor based on shared targets, technical capabilities and operational methods. However, they said further investigation is needed before the campaign can be definitively attributed.

The full report is available on Securelist.

To help organisations protect themselves, Kaspersky GReAT recommends:

• Remaining vigilant for indicators of compromise (IoCs) associated with GoSerpent and the other tools identified in the report.

• Deploying cybersecurity solutions that provide comprehensive threat detection, investigation and response capabilities, including:

- Kaspersky Next, which offers unified real-time protection, threat visibility, and EDR/XDR capabilities.

- Kaspersky Security for Mail Server, which protects email communications through anti-phishing technology, attachment sandboxing and business email compromise protection.

- Kaspersky Digital Footprint Intelligence, which monitors external attack surfaces and the dark web for exposed credentials.

- Kaspersky Compromise Assessment, Managed Detection and Response, and Incident Response, which help organisations detect advanced cyberattacks, investigate incidents and strengthen their security capabilities.

About the Global Research & Analysis Team

Established in 2008, Kaspersky's Global Research & Analysis Team (GReAT) investigates advanced persistent threats (APTs), cyber-espionage campaigns, ransomware, major malware and underground cybercrime trends worldwide. The team comprises more than 35 cybersecurity researchers based across Europe, Russia, Latin America, Asia and the Middle East, specialising in the analysis of emerging cyberthreats and malware.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. Innovating the industry with a Cyber Immunity approach, Kaspersky safeguards consumers, businesses, critical infrastructure and governments from cyberthreats, with more than one billion devices protected to date.

Kaspersky ensures Cybersecurity True to Business, focusing on delivering clear outcomes, protecting revenue, easing workloads and preventing downtime. Kaspersky's deep threat intelligence and security expertise are constantly transformed into innovative solutions and services for organizations of every size, from small businesses to large enterprises, combining proven AI-driven protection technologies with simple management and expert support.

Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps organizations detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to its clients. Learn more at www.kaspersky.com.