New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage

Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering. Russian cybersecurity company Kaspersky, which uncovered the activity in February 2026, said it was aimed at government and diplomatic entities in

The article reports Kaspersky’s discovery of GoSerpent, a Go-based malware/backdoor used in long-running cyber-espionage campaigns against Southeast Asian government and diplomatic entities, focused on persistent access, credential theft, and sensitive data exfiltration.[1][2][3][4][9] The tooling includes proxy capabilities, remote access, credential dumping, and staged data theft—indicating a well-resourced actor conducting strategic intelligence collection rather than opportunistic crime.[1][2][3][6] From a RealGround perspective, such persistence-centric espionage tooling raises the risk that similar tradecraft could be adapted to target AI infrastructure (agent backends, orchestration layers, or data lakes feeding AI models), compromising model inputs, training data, and credentials for AI services. Practically, organizations should implement continuous red teaming of AI-integrated environments and enforce strong identity, network egress, and supply-chain controls around AI agents and orchestration services to prevent GoSerpent-style footholds from being used to pivot into AI systems.