APT-Q-27 Launches Stealthy Attacks on Corporate Networks, Evades Detection

A new, highly sophisticated cyberattack campaign that reveals how attackers are bypassing modern defenses to infiltrate corporate networks.

The investigation points to a stealthy, multi-stage intrusion likely orchestrated by the threat group known as APT-Q-27, or “GoldenEyeDog”.

The attack began with a common, everyday task: a customer support agent clicking a link in a support ticket. The link, delivered via Zendesk, appeared to lead to an image file.

In mid-January 2026, CyStack’s security team observed anomalous activity on a corporate customer’s environment. 

However, it actually downloaded a malicious file with a .pif extension a legacy Windows file type that functions like a standard executable program.

Because file extensions are often hidden on corporate computers, the file looked harmless. To further disguise the attack, the file was digitally signed with a valid security certificate.

This digital signature acted as a “hall pass,” allowing the malicious program to bypass reputation checks and security warnings that usually block unknown software from the internet.

Hiding in Plain Sight

Once run, the malware did not immediately unleash its full payload. Instead, it acted as a “dropper,” a small program designed to set up the environment for the real attack.

It contacted a cloud storage server to download additional components, which it hid in a folder designed to look like a standard Windows Update cache.

The attackers used a clever technique known as “DLL sideloading” to run their malicious code. They placed a malicious file named crashreport.dll next to a legitimate, signed program called updat.exe.

When the legitimate program ran, it automatically loaded the malicious file, believing it was a necessary component. This allowed the attackers to execute their code inside a trusted process, effectively hiding their activity from security tools.

The most dangerous aspect of this campaign was its ability to operate almost entirely in the computer’s memory.

The malware decrypted its main backdoor payload directly into RAM, meaning the malicious code never existed as a standalone file on the hard drive. This “fileless” approach makes it incredibly difficult for traditional antivirus scans to detect the infection.

The malware also modified system settings to turn off User Account Control (UAC) prompts, ensuring it could make bigger changes to the system without alerting the user.

Links to APT-Q-27 (GoldenEyeDog)

While attribution is rarely 100% certain, the CyStack team found strong evidence linking this campaign to APT-Q-27, a group also known as GoldenEyeDog.

It then established persistence by creating a fake Windows service, ensuring it would restart automatically whenever the computer was rebooted.

The command-and-control (C2) servers used in the attack followed naming conventions previously seen in GoldenEyeDog campaigns, such as the use of “goldeye” in domain names.

The attack infrastructure and the “plugin-based” design of the backdoor which allows attackers to add new capabilities like screen recording or file theft on the fly closely match the group’s established toolkit.

APT-Q-27 has a history of targeting gambling and technology sectors with similar “watering hole” tactics and fake software installers.

This incident highlights a critical gap in traditional security monitoring. Because the attack used valid digital signatures and legitimate-looking processes, it did not trigger standard alerts.

Security experts recommend that organizations move beyond simple file scanning and focus on behavior-based monitoring.

Detecting abnormal patterns such as a support tool communicating with unknown servers or a legitimate program loading an unexpected file is often the only way to catch these “low-noise” intrusions before they cause significant damage.

IOCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.