APT-Q-27 Targeting Corporate Environments in Stealthy Attack Without Triggering Alerts

**CyStack** reported a mid-January 2026 targeted, highly stealthy malware campaign against financial institutions attributed to APT-Q-27 (GoldenEyeDog); the intrusion began via a malicious Zendesk ticket link delivering a disguised .pif executable that used a timestamped signed certificate to bypass SmartScreen, then performed DLL sideloading (crashreport.dll) and in-memory execution from a deceptive Windows Update–like staging directory, enabling persistent C2 and modular payload delivery while avoiding typical endpoint detections.