Who is Subgroup: Goldmouse, APT-C-27?

Subgroup: Goldmouse, APT-C-27 is a threat actor attributed to Syria, also known as Goldmouse, Golden Rat, APT-C-27. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Subgroup: Goldmouse, APT-C-27 exploit?

Subgroup: Goldmouse, APT-C-27 is known to exploit 1 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Subgroup: Goldmouse, APT-C-27

Also known as: Goldmouse, Golden Rat, APT-C-27, ATK 80, GoldMouse, Golden RAT, ATK80

SyriaInformation theft and espionage

Exploited CVEs

Overview

A subgroup of Syrian Electronic Army (SEA), Deadeye Jackal . ( Qihoo 360 ) On March 17, 2019, 360 Threat Intelligence Center captured a target attack sample against the Middle East by exploiting WinRAR vulnerability (CVE-2018-20250), and it seems that the attack is carried out by the Goldmouse APT group (APT-C-27). There is a decoy Word document inside the archive regarding terrorist attacks to lure the victim into decompressing. When the archive gets decompressed on the vulnerable computer, the embedded njRAT backdoor (Telegram Desktop.exe) will be extracted to the startup folder and then triggered into execution if the victim restarts the computer or performs re-login. After that, the attacker is capable to control the compromised device.

Exploited Vulnerabilities

CVE ID	Action
CVE-2018-20250