Loading threat actor…
Goldmouse, also tracked by some vendors as APT-C-27, is a Syria-linked threat actor associated with malware activity against targets in the Middle East. The group has been connected to njRAT-related operations and to spear-phishing campaigns that use socially engineered lures and archive-based malware delivery. Reported activity includes the use of password-protected or exploit-laden archives, Visual Basic Script and .NET payloads, and persistence mechanisms that place malware in user startup locations. Goldmouse-linked tooling and related samples have been observed abusing CVE-2018-20250, the WinRAR ACE path traversal vulnerability, to drop payloads for execution and persistence. Associated malware chains have included .NET implants and njRAT-family payloads capable of collecting host information, communicating with command-and-control infrastructure over HTTP, and executing staged content. Observed functionality in related njRAT activity includes victim profiling, keylogging, registry interaction, webcam-related surveillance features, self-deletion, and general remote-access capabilities. The actor’s operations are tied to Middle East targeting, with reporting specifically linking Goldmouse-associated samples to campaigns aimed at Israeli defense-related entities. Tradecraft reflected in these cases includes spear-phishing for initial access, tailored lure construction, persistence via startup-folder placement, and post-compromise collection and remote control. Based on the supplied evidence, Goldmouse is best characterized as a regionally focused intrusion actor aligned with espionage-oriented objectives rather than ransomware or financially motivated extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a past user of njRAT for information theft and espionage.
Referenced as a related activity cluster tied by another researcher to similar Middle East-targeting ACE exploit samples using CVE-2018-20250.
Referenced as a related cluster tied by another analysis to similar Middle East-targeting ACE exploit samples, not as the primary subject of this report.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.