APT-C-34__2019__APT-C-34.cn.pdf

360 Core Security describes discovery of a previously unreported Russian‑language APT named Golden Falcon (APT‑C‑34) that conducts targeted espionage across Central Asia (primarily Kazakhstan). The group uses a mix of custom malware (Harpoon), modified legitimate remote‑access tools (TeamViewer/RMS hijacks), and purchased commercial surveillance tools (HackingTeam RCS v10.3.0 and NSO Pegasus), delivering implants via spear‑phishing, USB/offline installers and specialized radio/hardware intercept devices to exfiltrate sensitive government, research, media and diplomatic data.