MalwareUsed by 3 actors

Golden Gh0st RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GoldenEyeDog

In this blog, we review the behavior and capabilities of a malware we call Golden Gh0st Loader and Golden Gh0st RAT... Golden Gh0st RAT’s main feature is remote access, and is a modified version of the Gh0st RAT.

via expel blogexpel.com

CylindricalCanine

via expel blogexpel.com

APT-Q-27

via expel blogexpel.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

the initial delivery and lure are different: the malware was distributed through a watering hole website offering a VPN download.

T1566PhishingEvidence1

Golden Gh0st RAT is used primarily in phishing emails and/or submissions to support portals... The mainstay tactic of this attacker is to send files disguised as screenshots in phishing emails.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1059.003Windows Command ShellEvidence1

Creates a .BAT script if it doesn’t exist. The .BAT script checks for the malware running, if not, it will start it

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1543.003Windows ServiceEvidence1

Self-destruct—deletes payload files... stops and deletes Windows service persistence

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1543.003Windows ServiceEvidence1

Self-destruct—deletes payload files... stops and deletes Windows service persistence

T1548.002Bypass User Account ControlEvidence1

UAC bypass—re-launches self via ShellExecuteExA("runas") then exits

Stealth

4 techniques

T1070Indicator RemovalEvidence1

Uses “RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255” to clear Internet Explorer user data (cookies, history, cache, etc)

T1070.001Clear Windows Event LogsEvidence1

Windows Event Log wiper—clears Application, Security, System logs

T1070.004File DeletionEvidence1

Recursive file/directory delete... Self-destruct—deletes payload files

T1218.011Rundll32Evidence1

Uses “RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255” to clear Internet Explorer user data

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

actors use code-signing certificates to keep Windows’s SmartScreen from preventing unsigned EXE and MSI files from running... then used the certificates to sign their own malware.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

DllKeyboard Keylogger module start

T1555Credentials from Password StoresEvidence1

Browser credential collection via CDllManager module... Chrome —reads User Data profile (Login Data)... Firefox profile... Skype... QQ Browser

Discovery

2 techniques

T1057Process DiscoveryEvidence1

DllSystem Process enumeration ... Process listing with full image paths via GetProcessImageFileNameA

T1082System Information DiscoveryEvidence1

Victim fingerprint sent to the C2

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

DllSerStart Delivers plug32.dll payload to enable an RDP backdoor

Collection

2 techniques

T1056.001KeyloggingEvidence1

DllKeyboard Keylogger module start

T1113Screen CaptureEvidence1

0x1565 sub_1001c723 Recon Screenshot capture

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The malware uses plain (not TLS/SSL encrypted) WebSocket traffic to communicate with the command and control server.

T1090ProxyEvidence1

fnProxy SOCKS/TCP proxy tunnel start

T1219Remote Access ToolsEvidence1

Golden Gh0st RAT’s main feature is remote access, and is a modified version of the Gh0st RAT.

Impact

1 technique

T1529System Shutdown/RebootEvidence1

Remote shutdown/reboot/logoff

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

expel blogNews

Jul 15, 2026

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident | Expel

A modified Gh0st RAT variant used by GoldenEyeDog/CylindricalCanine, primarily delivered via phishing or support portal submissions. It provides remote access and modular plugin-based capabilities including keylogging, screenshot capture, SOCKS proxying, credential theft, command execution, persistence, anti-forensics, and delivery of an RDP backdoor plugin.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 3 actors

Golden Gh0st RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GoldenEyeDog

via expel blogexpel.com

CylindricalCanine

via expel blogexpel.com

APT-Q-27

via expel blogexpel.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

the initial delivery and lure are different: the malware was distributed through a watering hole website offering a VPN download.

T1566PhishingEvidence1

Golden Gh0st RAT is used primarily in phishing emails and/or submissions to support portals... The mainstay tactic of this attacker is to send files disguised as screenshots in phishing emails.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1059.003Windows Command ShellEvidence1

Creates a .BAT script if it doesn’t exist. The .BAT script checks for the malware running, if not, it will start it

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1543.003Windows ServiceEvidence1

Self-destruct—deletes payload files... stops and deletes Windows service persistence

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Self-destruct—deletes payload files, deletes “Windos Defende” scheduled task

T1543.003Windows ServiceEvidence1

Self-destruct—deletes payload files... stops and deletes Windows service persistence

T1548.002Bypass User Account ControlEvidence1

UAC bypass—re-launches self via ShellExecuteExA("runas") then exits

Stealth

4 techniques

T1070Indicator RemovalEvidence1

Uses “RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255” to clear Internet Explorer user data (cookies, history, cache, etc)

T1070.001Clear Windows Event LogsEvidence1

Windows Event Log wiper—clears Application, Security, System logs

T1070.004File DeletionEvidence1

Recursive file/directory delete... Self-destruct—deletes payload files

T1218.011Rundll32Evidence1

Uses “RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255” to clear Internet Explorer user data

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

actors use code-signing certificates to keep Windows’s SmartScreen from preventing unsigned EXE and MSI files from running... then used the certificates to sign their own malware.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

DllKeyboard Keylogger module start

T1555Credentials from Password StoresEvidence1

Browser credential collection via CDllManager module... Chrome —reads User Data profile (Login Data)... Firefox profile... Skype... QQ Browser

Discovery

2 techniques

T1057Process DiscoveryEvidence1

DllSystem Process enumeration ... Process listing with full image paths via GetProcessImageFileNameA

T1082System Information DiscoveryEvidence1

Victim fingerprint sent to the C2

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

DllSerStart Delivers plug32.dll payload to enable an RDP backdoor

Collection

2 techniques

T1056.001KeyloggingEvidence1

DllKeyboard Keylogger module start

T1113Screen CaptureEvidence1

0x1565 sub_1001c723 Recon Screenshot capture

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The malware uses plain (not TLS/SSL encrypted) WebSocket traffic to communicate with the command and control server.

T1090ProxyEvidence1

fnProxy SOCKS/TCP proxy tunnel start

T1219Remote Access ToolsEvidence1

Golden Gh0st RAT’s main feature is remote access, and is a modified version of the Gh0st RAT.

Impact

1 technique

T1529System Shutdown/RebootEvidence1

Remote shutdown/reboot/logoff

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

expel blogNews

Jul 15, 2026

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident | Expel

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.