GoldenEyeDog (tracked internally as APT-Q-27 by Qi’anxin) is a hacking group targeting people involved in gaming and dog-pushing in Southeast Asia, as well as the overseas Chinese community, with a range of business activities including remote control, mining, DDoS attacks, etc.
It is related to a larger attack group tracked by Qi’anxin, the Miuuti Group. The Miuuti Group has repeatedly used puddle sites to host malware installation packages and implant Trojans into victims’ devices, and has used languages such as .NET, C++ , Go, and Delphi to develop malware, with a high level of overall immunity to kill in the attack samples. GoldenEyeDog deployed fake software download websites, and then used different methods to lure victims to download and install its malicious programs.
Read more…
Source: Qi’anxin Threat Intelligence Center
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan
February 27, 2025
In January 2025, FortiGuard Labs observed an attack that used Winos4.0, an advanced malware framework actively used in recent threat campaigns, to target companies in Taiwan. According to a report released in November 2024, Winos4.0 was distributed through gaming-related applications, however, it spread via an email masquerading as from Taiwan’s National Taxation Bureau in the campaign ...
- PayPal’s “no-code checkout” abused by scammers
February 27, 2025
Malwarebytes Labs recently identified a new scam targeting PayPal customers with very convincing ads and pages. Crooks are abusing both Google and PayPal’s infrastructure in order to trick victims calling for assistance to speak with fraudsters instead. Combining official-looking Google search ads with specially-crafted PayPal pay links, makes this scheme particularly dangerous on mobile devices due ...
- How hackers ruined a Disney employee’s life after he downloaded AI photo tool
February 27, 2025
A former Disney employee’s world was turned upside down when he downloaded an artificial intelligence-powered photo program, unaware that it was laced with hacking software, during a massive data breach at the entertainment giant. In July, Matthew Van Andel, an engineer at Disney at the time, got a message on the chat forum Discord from an ...
- Proof-of-Concept Exploits Released for RSync Vulnerabilities
February 26, 2025
Five vulnerabilities have been discovered within the RSync utility. RSync is a popular tool for transferring and synchronising files between different systems. RSync is commonly used in Unix-like operating systems. CVE-2024-12084 is a ‘heap-based buffer overflow’ vulnerability, with a CVSSv3 score of 9.8. When used alongside CVE-2024-12085, attackers could gain remote code execution (RCE). CVE-2024-12085 is an ...
- Ninth day of pro-Russia cyber attacks on Italian sites
February 25, 2025
A pro-Russian hacker group, Noname057(16), staged for the ninth consecutive morning on Tuesday a new wave of cyberattacks against Italian websites, specifically targeting local administrations. The provinces of Trapani, Ragusa, Caltanissetta, Enna, the municipality of Catania and the Puglia region were among those affected by the attacks. The Agency for National Cybersecurity is providing help to ...
- The GitVenom campaign: cryptocurrency theft using GitHub
February 24, 2025
In our modern world, it’s difficult to underestimate the impact that open-source code has on software development. Over the years, the global community has managed to publish a tremendous number of projects with freely accessible code that can be viewed and enhanced by anyone on the planet. With more and more open-source projects being published, both ...