Sophisticated Malware Campaign Targets Web3 Support Teams via Fake Screenshots A highly targeted malware campaign is exploiting customer support channels of Web3 platforms, with decentralized exchange 1inch recently identifying a persistent threat aimed at its staff. Attackers masquerade as frustrated users seeking transaction assistance, sharing links disguised as innocuous screenshots. Instead, these links trigger a multi-stage infection chain designed to compromise workstations and establish persistent backdoor access. This shift marks a tactical evolution for threat actors, moving from passive watering-hole attacks to direct social engineering against customer-facing employees. Security researchers have attributed the activity with moderate confidence to APT-Q-27 (GoldenEyeDog), a financially motivated Chinese-nexus group active since at least 2022. The group has a documented history of targeting the global cryptocurrency and gambling sectors. ### Attack Anatomy The malware employs a custom runtime encryption scheme to conceal strings, preventing plaintext URLs or file paths from being stored on disk. Upon execution, the initial loader performs anti-debugging and sandbox-evasion checks before retrieving a payload manifest from an AWS S3 dead drop. The malware then downloads a six-file package into a hidden staging directory, impersonating the Windows Update cache (with a unique @27 tag) to evade detection. The attack leverages DLL sideloading, using a legitimately signed executable (updat.exe) from the YY platform. Since Windows prioritizes local directory dependencies, the malicious vcruntime140.dll and msvcp140.dll files are loaded instead, executing within the context of a trusted application and bypassing signature verification. ### Infrastructure & Attribution The final backdoor communicates with 37 distinct command-and-control (C2) servers over TCP port 15628, using a 16-byte rolling XOR cipher to encrypt traffic. Several C2 IPs reside on autonomous systems previously linked to APT-Q-27, with geolocation obfuscation masking their origins. Key indicators include: - Initial loader (photo2025060268jpg.exe) – Disguised as an image file. - Primary loader (Feedback.exe) – .NET dropper. - Legitimate binary (updat.exe) – Used for sideloading. The campaign underscores the growing sophistication of threats targeting Web3 infrastructure, where social engineering and evasion techniques are increasingly refined.