Loading threat actor…
Gold Eye Dog, also tracked as APT-Q-27, is a suspected China-linked threat actor associated with the delivery of sophisticated certificate-signed backdoors through cloud-hosted infrastructure, including abuse of AWS S3 for payload delivery. The group has been observed using command-and-control infrastructure hosted across Chinese telecommunications and cloud providers, reflecting operational reliance on resilient, scalable hosting environments. Gold Eye Dog has been linked to backdoor deployment and broader post-compromise activity consistent with advanced intrusion operations. Reported tradecraft indicates use of signed malware, staged delivery infrastructure, and command-and-control patterns aligned with persistent access and defense evasion. The actor appears to operate within the broader ecosystem of China-linked intrusion activity that leverages shared hosting providers and reusable malware infrastructure rather than exclusively bespoke infrastructure. High-confidence reporting in the available material is limited, and detailed victimology, sector focus, and full intrusion lifecycle tradecraft are not sufficiently corroborated here. No confirmed sub-groups or additional widely established aliases beyond APT-Q-27 are available from the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.