APT-C-27

🇸🇾SY-attributed

campaigns

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the Syrian region using Android and Windows malwares. Its objective is the theft of sensitive information.

Threat Analysis

APT-C-27 is a known-sophistication threat actor attributed to SY, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

APT-C-27 — Active Operations March 2026

APT-C-27 is a unknown-motivation threat actor attributed to SY. A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the Syrian region using Android and Windows malwares. Its objective is the theft of sensitive information....

ACTIVEMEDIUM2026

External References

→https://ti.360.net/blog/articles/apt-c-27-(goldmouse):-suspected-target-attack-against-the-middle-east-with-winrar-exploit-en/

→https://ti.360.net/blog/articles/analysis-of-apt-c-27/

→https://web.archive.org/web/20180827024318/http://csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf

Quick Facts

TypeAPT / Threat Group

Origin🇸🇾 SY

Aliases4

SourceMalpedia

Also Known As

ATK80GoldMouseGolden RATAPT-C-27

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search APT-C-27