Loading malware…
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On April 7, 2026, a new sample of the long-running malicious sims-4-updater.exe campaign surfaced on MalwareBazaar... The implant is a custom-virtualized PE64 backdoor whose runtime artifacts (mutex Global\DHGGlobalMutex, registry keys HKCU\offlinekey\open / HKCU\offlinekey\clipboard) match documented APT-Q-27 / GoldenEyeDog / Dragon Breath tooling.
On April 7, 2026, a new sample of the long-running malicious sims-4-updater.exe campaign surfaced on MalwareBazaar... The implant is a custom-virtualized PE64 backdoor whose runtime artifacts (mutex Global\DHGGlobalMutex, registry keys HKCU\offlinekey\open / HKCU\offlinekey\clipboard) match documented APT-Q-27 / GoldenEyeDog / Dragon Breath tooling.
On April 7, 2026, a new sample of the long-running malicious sims-4-updater.exe campaign surfaced on MalwareBazaar... The implant is a custom-virtualized PE64 backdoor whose runtime artifacts (mutex Global\DHGGlobalMutex, registry keys HKCU\offlinekey\open / HKCU\offlinekey\clipboard) match documented APT-Q-27 / GoldenEyeDog / Dragon Breath tooling.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.