New APT-Q-27 sample spotted

A new campaign has been identified utilizing a valid digital signature from a Chinese technology company that remains unrevoked. The attack chain employs a dropper that retrieves an extension-based module list from command and control infrastructure. The malicious payloads exploit DLL Side-Loading techniques through a legitimate Tencent-signed executable to achieve code execution. The infrastructure includes Google Cloud Storage and a dedicated domain for command and control operations. Multiple components have been identified including an EXE dropper, DLL loader, DAT payload, and the legitimate Tencent executable used for side-loading purposes.

• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• Dissection of Operation FlashHole, a complex attack by LazarusMalware2026-10-21
• From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion ChainMalware2026-10-12
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• August 2026 Infostealer Trend ReportMalware2026-09-22