MalwareUsed by 1 actor

ThumbcacheService

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TetrisPhantom

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

via security online infosecurityonline.info

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence3

TmcLoader is a stealthy C++ loader module registered as a Windows service.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence3

TmcLoader is a stealthy C++ loader module registered as a Windows service.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence2

This malware receives encrypted and base64-encoded command-line arguments... ThumbcacheService employs XOR encryption... TmcLoader employs dynamic API resolution through a circular XOR encryption... combined with Base64 encoding for string obfuscation.

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

T1003.001LSASS MemoryEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

T1003.002Security Account ManagerEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

It specifically targets documents with the following extensions... The malicious service also monitors the $Recycle.Bin directory for deleted files with the extensions of interest.

Collection

4 techniques

T1005Data from Local SystemEvidence3

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

T1039Data from Network Shared DriveEvidence2

Stolen credentials from phase one make that quiet, share-based transfer possible.

T1213Data from Information RepositoriesEvidence1

The malicious service also monitors the $Recycle.Bin directory for deleted files with the extensions of interest, ensuring comprehensive data collection.

T1560Archive Collected DataEvidence3

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence3

After several days, it pulls in helper tools.

Exfiltration

2 techniques

T1011Exfiltration Over Other Network MediumEvidence1

TmcPayload reads a config file holding network-share credentials and destinations. It then ships out the exact database that ThumbcacheService built.

T1029Scheduled TransferEvidence1

After the initial phase of the malware deployments, the attackers allowed a few weeks for the ThumbcacheService to silently collect sensitive files without exfiltrating them.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

security online infoNews

Jul 24, 2026

GoSerpent Backdoor Targets Southeast Asian Governments

A malicious service used in the campaign to collect files, target Office documents and PDFs, create password-protected archives, and monitor the Recycle Bin as part of staged collection before exfiltration.

malware newsNews

Jul 16, 2026

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - Malware News - Malware Analysis, News and Indicators

A malicious Windows service DLL used to collect sensitive documents, monitor deleted files in $Recycle.Bin, archive targeted files into thumbcache_605a.db using 7-Zip with a preset password, and stage them for later exfiltration.

securelistNews

Jun 11, 2026

GoSerpent backdoor attacks in Southeast Asia | Securelist

Malicious Windows service DLL used to collect sensitive documents, archive them with 7-Zip into thumbcache_605a.db, and monitor deleted files in $Recycle.Bin for later exfiltration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

ThumbcacheService

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TetrisPhantom

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

via security online infosecurityonline.info

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence3

TmcLoader is a stealthy C++ loader module registered as a Windows service.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence3

TmcLoader is a stealthy C++ loader module registered as a Windows service.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence2

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

T1003.001LSASS MemoryEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

T1003.002Security Account ManagerEvidence1

Meanwhile, credential dumpers pull secrets from LSASS memory and the SAM hive.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

It specifically targets documents with the following extensions... The malicious service also monitors the $Recycle.Bin directory for deleted files with the extensions of interest.

Collection

4 techniques

T1005Data from Local SystemEvidence3

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

T1039Data from Network Shared DriveEvidence2

Stolen credentials from phase one make that quiet, share-based transfer possible.

T1213Data from Information RepositoriesEvidence1

The malicious service also monitors the $Recycle.Bin directory for deleted files with the extensions of interest, ensuring comprehensive data collection.

T1560Archive Collected DataEvidence3

A malicious service called ThumbcacheService then collects files. It targets Office documents and PDFs, archives them with 7-Zip under a set password, and even watches the Recycle Bin.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence3

After several days, it pulls in helper tools.

Exfiltration

2 techniques

T1011Exfiltration Over Other Network MediumEvidence1

TmcPayload reads a config file holding network-share credentials and destinations. It then ships out the exact database that ThumbcacheService built.

T1029Scheduled TransferEvidence1

After the initial phase of the malware deployments, the attackers allowed a few weeks for the ThumbcacheService to silently collect sensitive files without exfiltrating them.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

security online infoNews

Jul 24, 2026

GoSerpent Backdoor Targets Southeast Asian Governments

malware newsNews

Jul 16, 2026

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - Malware News - Malware Analysis, News and Indicators

securelistNews

Jun 11, 2026

GoSerpent backdoor attacks in Southeast Asia | Securelist

Malicious Windows service DLL used to collect sensitive documents, archive them with 7-Zip into thumbcache_605a.db, and monitor deleted files in $Recycle.Bin for later exfiltration.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.