APT-C-27 — APT Profile
APT-C-27, also tracked as GoldMouse, Golden RAT and ATK80, ran a sustained espionage campaign against targets in Syria and the wider Middle East from late 2014, pairing Windows implants with Android surveillance tooling to lift sensitive documents and communications. Qihoo 360's Threat Intelligence Center, which assigned the APT-C-27 designation, documented the mobile side as the GoldenRat family and first exposed the operation publicly in July 2018. In March 2019 the same team, by then Qi Anxin, reported the operators weaponising the WinRAR path-traversal flaw CVE-2018-20250 inside decoy documents to drop an njRAT backdoor that posed as a Telegram desktop binary and persisted from a startup folder. Malpedia dates the earliest activity to November 2014 and states no country of origin for the group, and no source reached here assigns it a sponsoring state. The reporting trail appears to stop in 2019, and the group is carried here as dormant.Also tracked as
GoldMouse, Golden RAT, ATK80
Tools & malware
- apk.goldenrat Mobile Malware
Vendor research
- The sample analysis of APT-C-27's recent attack Qihoo 360 (360 Total Security)
- APT-C-27 (Goldmouse): Suspected Target Attack against the Middle East with WinRAR Exploit QiAnXin Threat Intelligence Center (formerly 360 Threat Intelligence Center)
- 黄金鼠组织--叙利亚地区的定向攻击活动 (Golden Rat Organization — Targeted Attack Activity in the Syrian Region) QiAnXin Threat Intelligence Center (formerly 360 Threat Intelligence Center)