- Category
- State · Attributed to a state or working for one.
- Origin
- Syria(medium confidence)contested
- Sponsor
- Syrian Electronic Army
- Motivation
- Information theft and espionage
- Seen
- 2014
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0125 · goldmouse
SyriaWhat it is
A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the Syrian region using Android and Windows malwares. Its objective is the theft of sensitive information.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Deadeye Hawk
- Qihoo 360
- APT-C-27
- Thales
- ATK80
- Other names
- ATK 80, Golden Rat, Goldmouse, APT-C-27
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Middle East, Syria
Tools
The tools and malware families the sources tie to it.
- Androrat
- DroidJack
- GoldenRAT
- Windows Remote Desktop
- a WinRAR exploit
- njRAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net