GoldenEyeDog (tracked internally as APT-Q-27 by Qi’anxin) is a hacking group targeting people involved in gaming and dog-pushing in Southeast Asia, as well as the overseas Chinese community, with a range of business activities including remote control, mining, DDoS attacks, etc.
It is related to a larger attack group tracked by Qi’anxin, the Miuuti Group. The Miuuti Group has repeatedly used puddle sites to host malware installation packages and implant Trojans into victims’ devices, and has used languages such as .NET, C++ , Go, and Delphi to develop malware, with a high level of overall immunity to kill in the attack samples. GoldenEyeDog deployed fake software download websites, and then used different methods to lure victims to download and install its malicious programs.
Read more…
Source: Qi’anxin Threat Intelligence Center
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- MontysThree: Industrial espionage with steganography and a Russian accent on both sides
October 8, 2020
In summer 2020 we uncovered a previously unknown multi-module C++ toolset used in highly targeted industrial espionage attacks dating back to 2018. Initially the reason for our interest in this malware was its rarity, the obviously targeted nature of the campaign and the fact that there are no obvious similarities with already known campaigns at ...
- HEH P2P Botnet Sports Dangerous Wiper Function
October 8, 2020
A freshly discovered botnet dubbed HEH by researchers is casting a wide net, looking to infect any and all devices that use Telnet on ports 23/2323. It’s particularly destructive: It contains code that wipes all data from infected systems. Perhaps ironically, its operators also have a penchant for civil advocacy – a loading of the Universal ...
- PoetRAT Resurfaces in Attacks in Azerbaijan Amid Escalating Conflict
October 8, 2020
A new iteration of the PoetRAT spyware, sporting improvements to operational security, code efficiency and obfuscation, is making the rounds in Azerbaijan, targeting the public sector and other key organizations as the country’s conflict with Armenia over disputed territory intensifies. Threat intelligence researchers have observed multiple new strikes using the malware that show a “change in ...
- Transforming IoT Monitoring Data into Threat Defense
October 8, 2020
In our midyear roundup report, we shared that in the first half of 2020, there was a 70% increase in inbound attacks on devices and routers compared with the second half of 2019. This data includes attacks on Internet of Things (IoT) systems, which remain alarming and prevalent. With the aim of protecting customers effectively by ...
- BAHAMUT Spies-for-Hire Linked to Extensive Nation-State Activity
October 7, 2020
A cyberespionage group known as BAHAMUT has been linked to a “staggering” number of ongoing attacks against government officials and private-sector VIPs in the Middle East and South Asia, while also engaging in wide-ranging disinformation campaigns. That’s according to BlackBerry researchers, who said that the highly resourced group is probably operating on a mercenary basis, offering ...
- US brokerage firms warned of widespread survey phishing attacks
October 7, 2020
The U.S. Financial Industry Regulatory Authority (FINRA) has issued a notice warning member brokerage firms of widespread phishing attacks using surveys to harvest information. FINRA is a non-profit organization and self-regulatory body authorized by the U.S. government to regulate exchange markets and brokerage firms. According to FINRA, the organization supervises over 624,000 brokers across the country and ...