Threat Actor Unknown origin

TetrisPhantom

TetrisPhantom relies on compromising of certain type of secure USB drives that provide hardware encryption and is commonly used by government organizations. While investigating this threat, experts identified an entire spying campaign that uses a range of malicious modules to execute commands, collect files and information from compromised computers and transfer them to other machines also using secure USB drives.

MITRE ATT&CK TTPs 15

T1021.003
Distributed Component Object Model
Lateral Movement
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1098
Account Manipulation
Persistence
 T1105
Ingress Tool Transfer
Command And Control
 T1110
Brute Force
Credential Access
 T1114
Email Collection
Collection
 T1129
Shared Modules
Execution
 T1133
External Remote Services
Persistence
 T1140
Deobfuscate/Decode Files or Information
Defense Evasion
 T1566
Phishing
Initial Access
 T1573
Encrypted Channel
Command And Control
 T1574
Hijack Execution Flow
Persistence

Source Articles

New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage
A previously undocumented malware named GoSerpent has been used in cyber espionage campaigns targeting government and diplomatic entities in Southeast Asia since late 2025. The malware enables long-term access, credential dumping, and data exfiltration through a suite of tools including Mimikatz, QuarksDumpLocalHash, and a custom file collection tool called ThumbcacheService. In May 2026, attackers returned to compromised environments to deploy evolved tools such as Stowaway and TmcLoader/TmcPayload for further data exfiltration. The activity shows operational overlaps with the TetrisPhantom threat actor, though definitive attribution remains unconfirmed.
hacker-news ·1w ago