Also known as: Double Dragon, BARIUM, Brass Typhoon, Wicked Panda, Winnti, LEAD, Red Kelpie, Earth Baku, Wicked Spider, Bronze Atlas, HOODOO, RedGolf, MISSION2025, UNC5221, Blackfly, Grayfly, Earth Freybug, Earth Longzhi, SparklingGoblin, UNIT2025, Leopard Typhoon
T1195.002
T1574.001
T1574.002
T1071.001
T1588.002
T1583.001
T1053.005
T1055.001
T1055.012
T1057
T1070.004
T1112
T1135
T1204.002
T1518.001
T1543.003
T1546.003
T1550.002
T1560.001
T1562.001
T1569.002
T1078.003
T1091
T1199
T1210
T1505.003
T1136.001
T1218.011
T1071.004
T1594
T1595.002
T1059.004
T1132.001
T1132.002
T1537
T1102.002
T1498
T1584.004
T1207
T1556.004
T1552.001
T1606.002
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Process Injection
Inject code into running processes to evade defenses and elevate privileges.
Obfuscated Files or Information
Encrypt, encode, or obfuscate payloads and data to evade detection.
Deobfuscate/Decode Files or Information
Decode or deobfuscate data and files that were previously hidden or encrypted.
Masquerading
Disguise malicious artifacts by manipulating names or locations to appear legitimate.
Ingress Tool Transfer
Download additional tools or payloads from an external system.
Protocol Tunneling
Tunnel network traffic through an existing protocol to avoid detection.
Proxy
Route C2 traffic through intermediary proxies to obscure the source.
Remote Access Software
Use legitimate remote access tools like TeamViewer or AnyDesk for C2.
Modular backdoor platform that was initially deployed via supply chain attack on NetSarang software. Features plugin-based architecture with encrypted C2 using custom DNS tunneling.
Signature rootkit-enabled backdoor shared across multiple Chinese APT groups. Provides persistent access with kernel-level capabilities for hiding processes and network connections.
Modular backdoor loaded via DLL side-loading. Supports keylogging, screen capture, file management, and loading additional plugins from C2 servers.
Versatile RAT shared across Chinese APT groups. Uses DLL side-loading for execution and supports HTTP/DNS/TCP C2 with encrypted communications.
Cross-platform (Windows/Linux) backdoor using WebSocket and custom TCP protocols for C2. Used in attacks against telecommunications and government sectors.
Downloader/launcher that deploys secondary payloads. Uses living-off-the-land binaries and DLL side-loading to maintain stealth during initial compromise.
In-memory dropper that loads encrypted payloads directly into process memory. Used in conjunction with DUSTTRAP for multi-stage deployment.
Passive backdoor for Linux servers that listens on existing network sockets. Extremely difficult to detect as it doesn't create new network connections.
Extensively used for post-exploitation in both espionage and financially motivated operations. Custom loaders deployed via supply chain or spear-phishing vectors.
Lightweight web shell (4KB) providing remote command execution on compromised web servers. Used for initial foothold maintenance and file management.
Used for credential extraction and Kerberos ticket manipulation during lateral movement phases in both espionage and cybercrime operations.
Python framework used for SMB relay attacks, remote execution via wmiexec/smbexec, and credential extraction via secretsdump.
Used for reconnaissance, downloading secondary payloads, disabling security controls, and executing in-memory malware to avoid disk-based detection.
Windows utility abused for downloading payloads from C2 servers and decoding Base64-encoded malware during multi-stage infection chains.
Compromised CCleaner v5.33 build environment in 2017 to distribute ShadowPad backdoor to 2.27 million users. One of the largest software supply chain attacks.
FreeBSD backdoor discovered targeting Citrix ADC/Gateway appliances. Demonstrates APT41's capability to target non-Windows network infrastructure.
Backdoor delivering Cobalt Strike BEACON payloads
Modular backdoor with support for proxy and file operations
Backdoor with kernel driver component for persistence
SMS interception tool targeting telecom infrastructure
Backdoor deployed through compromised software supply chains
UEFI firmware bootkit for stealth and persistence
Lightweight backdoor for remote access and reconnaissance
Cobalt Strike payload used for post-exploitation
Loader and backdoor used to deploy additional malware
Advanced backdoor variant evolved from StealthVector
Backdoor used in targeted espionage campaigns
Backdoor used for reconnaissance and lateral movement
Linux malware variant targeting ESXi hypervisors
Exploit framework targeting edge devices and network appliances
Web shell and backdoor used for persistence on compromised web servers
Loader component used to decrypt and execute additional payloads
Linux-based backdoor for compromised systems
Open-source tunneling tool abused for command and control communications
Linux backdoor targeting cloud environments
Credential harvesting tool targeting authentication credentials
Backdoor used for reconnaissance and command execution on compromised systems
Custom backdoor used for maintaining persistent access to compromised systems
Memory-only dropper malware used in APT41 campaigns
Privilege escalation tool leveraging Windows token manipulation
Modular malware framework used for persistent access and data exfiltration
Web-based backdoor and webshell management tool used for maintaining persistence on compromised web servers
Data collection and exfiltration framework deployed in targeted espionage operations
Backdoor with remote access capabilities
Backdoor malware used for maintaining access and executing commands
Web shell backdoor deployed on compromised servers for persistent access
Lightweight backdoor for initial access and reconnaissance
Shellcode loader used to execute additional malware stages
Remote access tool loader used to deploy secondary payloads
Modular backdoor with file manipulation and command execution capabilities
Remote access trojan deployed by APT41 for persistent access and command execution
Lightweight backdoor for command execution and data exfiltration
Malware variant deployed by APT41 for persistent access to compromised systems
Remote access trojan used for command and control operations
Legitimate Oracle database tool abused by APT41 for data exfiltration from compromised databases
DLL backdoor deployed by APT41 with capabilities for file operations and command execution
Passive backdoor leveraged by APT41 that monitors network traffic for specific triggers to activate
Tool used to detect security products and virtual machine environments before deploying additional malware
Custom backdoor used in APT41 operations for command and control
Second-stage backdoor providing remote access and file manipulation capabilities
Backdoor using DNS tunneling for command and control communications
SQL-based backdoor for persistence in Microsoft SQL Server environments
Backdoor used to maintain persistent access on compromised systems
Remote access trojan deployed via malicious PyPI packages targeting AI/ML developers
Go-based backdoor used by APT41 for initial access and establishing persistence on compromised systems
Custom loader used to deploy second-stage payloads while evading detection
Python-based backdoor used for reconnaissance and data exfiltration operations
Legitimate security software that APT41 has been observed disabling or removing to evade detection
Kernel-mode rootkit used for defense evasion and maintaining persistence
Ransomware variant deployed by APT41 in operations blending financial motivation with espionage
Web shell used for maintaining access to compromised web servers
Weaponized version of Cobalt Strike with modified configurations
Multi-stage loader used to deploy Cobalt Strike and other post-exploitation tools
Modular backdoor with extensive capabilities for espionage operations
Backdoor leveraging Google Drive for command and control communications
Backdoor malware used for persistent access and lateral movement
Collection of custom tools for credential theft and lateral movement
Remote access trojan with capabilities for command execution and data exfiltration
Second-stage backdoor with capabilities for file operations and command execution
Various ransomware families deployed for financial gain and potential false flag operations
Passive backdoor that listens for incoming connections on compromised systems
Backdoor used for command and control communications
Android surveillance tool with capabilities for location tracking, call recording, and data exfiltration
Custom exploit used by APT41 targeting ManageEngine vulnerabilities
Variant of DOUBLEPULSAR backdoor used for remote access
Web shell variant used for maintaining access to compromised web servers
Multi-stage malware loader used to decrypt and execute additional payloads
Data wiper malware deployed in targeted operations
Custom backdoor deployed for persistent remote access
Legitimate web vulnerability scanner repurposed for reconnaissance
Web shell deployed on compromised edge devices for persistent access
Credential harvesting implant targeting web applications and email systems
Second-stage loader used to deliver additional payloads
Custom backdoor used for command execution and lateral movement in APT41 operations
Linux backdoor used for cryptocurrency mining and persistence on compromised systems
Custom loader component used in multi-stage infection chains
Backdoor capable of executing commands and exfiltrating data
Application shim-based persistence mechanism used to establish backdoor access
| Type | Value |
|---|---|
| domain | ns1[.]clofrfrede[.]com |
| domain | infestexe[.]com |
| ip | 103[.]230[.]15[.]130 |
| ip | 149[.]28[.]78[.]89 |
| hash | 7966c2c546b71e800cddd2a6d3a8b0e1 |
| hash | 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360 |
| hash | 65da1a9026cf171a5a7779bc5ee45fb1 |
| hash | 39a46d7f1ef9b9a5e40860cd5f646b9d |
| url | hxxps[[://]]www[.]googleapis[.]com/calendar/v3/calendars/ff57964096cadc1a8733cf566b41c9528c89d30edec86326c723932c1e79ebf0@group[.]calendar[.]google[.]com/events |
| ip | 43[.]99[.]48[.]196 |
| ip | 146[.]70[.]87[.]67 |
| domain | ai[.]qianxing[.]co |
| domain | ns1[.]a1iyun[.]top |
| domain | ai[.]aliyuncs[.]help |
| url | tkshopqd[.]s3[.]amazonaws[.]com |
| domain | cdn[.]dellcdn[.]com |
| domain | update[.]centos-packages[.]com |
| ip | 103[.]27[.]109[.]217 |
| ip | 45[.]142[.]212[.]61 |
| hash | a4e9b7f76c2c7f1e8b3d4c5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c |
| domain | checkin[.]travelsanignacio[.]com |
| domain | cdn[.]oracleapi[.]org |
| ip | 45[.]77[.]253[.]135 |
| hash | 5d8c4b2d8f8f0e4f5c6e8a7c9d1f2e4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e |
| domain | webserver[.]selfip[.]biz |
| domain | cloudflare-api[.]com |
| domain | dns-update[.]com |
| hash | d42d9f8c2e6f8b5a4c3e1a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d |
| domain | www[.]chatgptapp[.]shop |
| domain | www[.]googleclouds[.]top |
| hash | c948ae14761095e4d76b55d9de86412258be7afd |
| ip | 45[.]77[.]243[.]211 |
| domain | checkin[.]travelsinfo[.]net |
| domain | update[.]centosupdates[.]com |
| ip | 154[.]223[.]129[.]227 |
| hash | b8a61adfe5f0452b57b4f9f62e8a5b8c8d6e9c5f1a2b3c4d5e6f7a8b9c0d1e2f |
| domain | checkin[.]travelsolutions[.]com |
| domain | cdn[.]chatgptapp[.]chat |
| ip | 45[.]77[.]170[.]235 |
| hash | 8b8e4c9c8c6f4e3f5a7d9c8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a |
| domain | webserver[.]microsofts[.]org |
| domain | update[.]iaaca[.]org |
| hash | b8c6d364cc2024a0b6d6d0fc9fcbf7d4 |
| ip | 45[.]77[.]36[.]243 |
| domain | checkin[.]repair-dns[.]com |
| domain | aws[.]amazoawss[.]com |
| ip | 45[.]77[.]243[.]133 |
| hash | e5b9a5d36b7e1b8f7a0c8e6f9d1a3b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a |
| domain | www[.]chatgptc[.]com |
| domain | smtp[.]outlookmails[.]com |
| ip | 45[.]77[.]21[.]211 |
| hash | 3c5c3e2c6c6c0b6b8f8f8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b |
| domain | webserver-globa1-check45632[[.]]com |
| domain | globalnetworkissues[[.]]com |
| ip | 45[.]32[.]13[.]180 |
| hash | b7f4d37f8f6a8f8e0e0f1d3c5a3b2e1f9c8d7a6b5c4d3e2f1a0b9c8d7e6f5a4b |
| domain | cdn[.]oracleaws[.]com |
| domain | smtp[.]dellmail[.]com |
| ip | 104[.]244[.]79[.]94 |
| hash | b7f4b7f9e5d5c5e5a5f5e5d5c5e5a5f5 |
| domain | download[.]windowsupdate[.]corp |
| domain | cdn[.]microsofts[.]org |
| ip | 45[.]77[.]243[.]15 |
| hash | b8c5b8f8f8f7b5e7d7f8e8d8c8b8a8f8e8d8c8b8a8f8e8d8c8b8a8f8e8d8c8b8 |
| domain | webmail[.]oracleservice[.]top |
| domain | update[.]driversolutions[.]net |
| hash | d42a3c6c4f6f5a8f5e9e2a0c7b8d9e6f3c4a5b7c8d9e0f1a2b3c4d5e6f7a8b9c |
| domain | update[.]iaacorporate[.]com |
| ip | 45[.]77[.]183[.]168 |
| hash | b8c5c59b6e1d5f0e7d5c0a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d |
| domain | webmail[.]joyobserve[.]com |
| domain | cdn[.]chatgptc[.]com |
| ip | 45[.]61[.]136[.]47 |
| hash | b82f7f02b0e8f3f6e7b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7 |
| domain | passport[.]livehost[.]live |
| domain | webmail[.]newsblog[.]club |
| hash | 8c8b0e4c7b79b5e5c3e4c5c8f1f1a8d5e0c7f8c5f5b5e7b8f0c7e5f8d5c7f8e5 |
| domain | www[.]carcarrental[[.]]com |
| domain | update[.]cloudjscdn[[.]]com |
| hash | e5b6c9d8f7a3b4c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8 |
| domain | cloud-security-net[.]com |
| hash | 8f6e2c1f8b5d4a3e9c7f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d |
| domain | cdn[.]oraclegovcloud[.]com |
| domain | verify[.]globaltrustassoc[.]com |
| hash | b4b9c8e1f3e7d5c6a2f8e9d7c5b3a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4 |
| domain | cdn[.]webanalytic[.]online |
| domain | update[.]versionchecker[.]net |
| hash | 8b9d8389e3b3d6f7d3e6c4a9f2e8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0 |
| domain | webmail[.]oarnational[.]com |
| domain | cdn[.]altimiterasw[.]com |
| hash | 8b3c4d9b6f2e1a7c5d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c |
| domain | ssl[.]arkouthrie[.]com |
| domain | global[.]aetherinc[.]com |
| hash | 8b5d4b7d2c3a1e6f9c4d3a2b1e5f6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a |
| domain | cdn[.]chatgptapi[.]org |
| hash | 5d6b6b3d3f5e5f5e8f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e |
| domain | webserver[.]homeunix[.]org |
| domain | www[.]chatconnecting[.]com |
| hash | 8b9f6a8e3c5e4f2a1d7b9c0e5f8a3b6c9d2e5f8a1b4c7d0e3f6a9b2c5d8e1f4a |
| domain | webmail[.]baggybill[.]com |
| domain | update[.]iaac[.]cloud |
| ip | 107[.]148[.]163[.]163 |
| domain | cdn[.]chatgptapp[.]shop |
| domain | webmail[.]microtechglobal[.]com |
| hash | 8b3c3d7f4e5a6b2c1d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c |
| domain | webserver-glb[.]com |
| domain | cdn-edge-akamai[.]com |
| ip | 45[.]76[.]179[.]163 |
| domain | microsoftdefenderupdate[.]com |
| domain | windowsprotection[.]net |
| hash | 5262cb9791df50fafbde0be3c7d4a66d7b8f5f1e8d8f4c7b3e7e8c0e9f2a1b3c |
| domain | mailserveropconfigservice[.]com |
| domain | cdn-office365management[.]com |
| ip | 154[.]223[.]149[.]62 |
| hash | c9b5d49eb5063e2f69f3d4c18e6f8c5e5f5a7b6c3d4e5f6a7b8c9d0e1f2a3b4c |
| domain | cloudflare-resolve[.]com |
| domain | microsoftdefence[.]com |
| hash | b9f2a1287b0d69b8d506e2c8e4c9a9e8f5a4c6b3e2d1a0f9e8d7c6b5a4e3d2c1 |
| domain | www[.]chatgptapp[.]org |
| domain | microsoftdefenderportal[.]com |
| hash | 5262cb9791af34c85f9e3fd636f1e6d1b5a8c7f90f40b0b1f3a8e3d5c6b7e8f9 |
| domain | www[.]chatgptapp[.]uk |
| domain | anydesk[.]ns01[.]info |
| hash | c74e89fd8bcf5a9c8e52be25c0c9c2e8dbce1f8e |
| ip | 45[.]77[.]36[.]17 |
| Domain / Host | Status |
|---|---|
ns1[.]clofrfrede[.]comShadowPad C2 infrastructure | offline |
infestexe[.]comCROSSWALK/DEADEYE C2 domain | offline |
103[.]230[.]15[.]130KeyPlug Linux backdoor C2 server | active |
149[.]28[.]78[.]89Infrastructure used in telecom targeting | offline |
thetavaluemetrics[.]com | active |
www[.]googleapis[.]com | ip_changed |
ai[.]qianxing[.]co | unknown |
ns1[.]a1iyun[.]top | unknown |
ai[.]aliyuncs[.]help | unknown |
tkshopqd[.]s3[.]amazonaws[.]com | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - APT41
https://attack.mitre.org/groups/G0096/
Mandiant - APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
U.S. DOJ - Seven International Cyber Defendants Charged
https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged
KEYPLUG Backdoor: APT41's Pivotal Tool for Cyber Espionage
https://www.group-ib.com/blog/apt41-keyplug/
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/blog/apt41-dual-espionage-and-cyber-crime-operation
Chinese APT41 Hackers Target Android Devices with WyrmSpy, DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-android.html
MoonBounce: the dark side of UEFI firmware
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
CISA Alert: APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ServiceDesk Plus
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-259a
Mandiant: APT41 Has Arisen From the DUST
https://www.mandiant.com/resources/blog/apt41-arisen-from-dust
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-certificates
Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html
KEYPLUG Backdoor Used by APT41 in Recent Campaigns
https://www.mandiant.com/resources/blog/APT41-keyplug-backdoor
APT41 World Tour 2021 on a Budget
https://www.mandiant.com/resources/blog/apt41-world-tour-2021
Operation CuckooBees: Deep-Dive into Stealthy Cyberus Campaign
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-cyberus-campaign
Mark Your Calendar: APT41 Innovative Tactics - Google Cloud
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
APT41 Cyber-Espionage Campaign Targets U.S. Policy Institutions - HivePro
https://hivepro.com/threat-advisory/apt41-cyber-espionage-campaign-targets-u-s-policy-institutions/
China-Linked APT41 Hackers Target U.S. Trade Officials - The Hacker News
https://thehackernews.com/2025/09/china-linked-apt41-hackers-target-us.html
APT PROFILE – MISSION2025 - CYFIRMA
https://www.cyfirma.com/research/apt-profile-mission2025/
APT41 Targets Linux Cloud Servers With New Winnti Backdoor - GBHackers
https://gbhackers.com/new-winnti-backdoor/
Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited - Freemindtronic
https://freemindtronic.com/chrome-v8-zero-day-cve-2025-6554-active-exploit/
China-Nexus Threat Actor Exploiting Ivanti EPMM - EclecticIQ
https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/reports/apt41-double-dragon-dual-espionage-and-cyber-crime-operation
APT41 Exploits Barracuda ESG Zero-Day Vulnerability
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
CISA Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Fortinet Zero-Day Exploited by APT41
https://www.fortinet.com/blog/psirt-blogs/analysis-of-fg-ir-23-365
APT41 World Tour 2021: Earth Baku Returns
https://www.trendmicro.com/en_us/research/22/f/apt41-earth-baku-returns.html
Chinese APT Groups Targeting Ivanti Connect Secure Devices
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-ivanti-connect-secure
APT41 Perfects Code Signing Abuse - Mandiant
https://www.mandiant.com/resources/blog/apt41-perfects-code-signing-abuse
ESET APT Activity Report Q3 2023-Q2 2024
https://www.welivesecurity.com/en/eset-research/apt-activity-report-q3-2023-q2-2024/
This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/i/apt41-perfects-code-signing-abuse.html
APT41 Uses Earth Freybug Malware to Target Governments
https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html
APT41 World Wide
https://www.mandiant.com/resources/reports/apt41-world-wide
Earth Longzhi Returns: Exploiting CVE-2023-32315
https://www.trendmicro.com/en_us/research/23/j/earth-longzhi-returns.html
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups/apt-41.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.sentinelone.com/labs/apt41-perfects-code-signing-abuse-to-escalate-supply-chain-attacks/
APT41 World Tour 2021 on a NEAR Protocol
https://www.mandiant.com/resources/blog/apt41-us-state-governments
Chinese APT Groups Exploiting CVE-2023-46747 in F5 BIG-IP
https://www.mandiant.com/resources/blog/china-nexus-espionage-f5-big-ip
APT41 Compromises Networks via Advanced Custom Malware
https://www.trendmicro.com/en_us/research/24/a/earth-freybug.html
Chinese Cyberespionage Group APT41 Targets Gambling Industry
https://www.trendmicro.com/en_us/research/24/b/chinese-cyberespionage-group-apt41-targets-gambling-industry.html
APT41 Perfects Code Signing Abuse and Demonstrates Sophisticated Threat
https://www.trellix.com/en-us/about/newsroom/stories/research/apt41-perfects-code-signing-abuse.html
APT41: A Dual Espionage and Cyber Crime Operation - FireEye
https://www.mandiant.com/resources/reports/apt41-dual-espionage-and-cyber-crime-operation
KEYPLUG Backdoor Used by APT41
https://www.mandiant.com/resources/blog/session-hijacking-keyplug-backdoor
APT41 Compromises Networks via F5 BIG-IP Vulnerability
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-f5-vulnerability
Chinese Espionage Group APT41 Struck Hundreds of Companies
https://www.trendmicro.com/en_us/research/21/l/apt41-earth-baku-returns.html
APT41 Has Arisen From the DUST
https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust
APT41: Double Dragon APT Group Analysis
https://www.recordedfuture.com/apt41-double-dragon-apt-group
Chinese APT Groups Targeting Southeast Asian Government Institutions
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-southeast-asian-government-institut.html
Earth Freybug Uses UNAPIMON for Unhooking Critical APIs
https://www.trendmicro.com/en_us/research/24/c/earth-freybug.html
Chinese Espionage Group APT41 Strikes Again
https://www.sentinelone.com/labs/chinese-espionage-group-apt41-strikes-again/
APT41 Leverages Google Command and Control
https://www.mandiant.com/resources/blog/apt41-google-command-control
CISA Alert: APT Actors Exploiting CVE-2024-23113 in FortiOS
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a
APT41 World Tour 2021 on a Big Data Platform
https://www.trendmicro.com/en_us/research/23/c/apt41-campaign-targeting-bigdata-platform.html
Earth Longzhi Resurfaces with New Techniques and Targets
https://www.trendmicro.com/en_us/research/24/b/earth-longzhi.html
Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques
Chinese APT Groups Target Semiconductor Industry - Mandiant 2024
https://www.mandiant.com/resources/blog/chinese-groups-target-semiconductor-industry
APT41 Leverages Google Services for C2 Communication - Mandiant 2024
https://www.mandiant.com/resources/blog/apt41-google-c2
Chinese APT41 Group Compromised Telecommunications Providers to Track Individuals
https://www.fireeye.com/blog/threat-research/2019/08/apt41-targeting-telecommunications.html
APT41 Chinese Threat Group Exploiting CVE-2024-23113
https://www.mandiant.com/resources/blog/chinese-nexus-espionage-fortinet-cve-2024-23113
Chinese APT41 Hackers Target Global Orgs in Latest Espionage Attack
https://symantec-enterprise-blogs.security.com/threat-intelligence/apt41-espionage-attack-2024
Chinese Espionage Group APT41 Strikes Again: Targets Telecommunications
https://www.sentinelone.com/labs/chinese-espionage-group-apt41-strikes-again-targets-telecommunications/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/24/e/apt41-perfects-code-signing-abuse.html
APT41 World Tour 2021
https://www.fireeye.com/blog/threat-research/2021/03/apt41-initiates-global-intrusion-campaign.html
Chinese Espionage Group APT41 Strikes Gambling Sector
https://www.recordedfuture.com/chinese-group-apt41-known-for-cyber-espionage
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-abuse
Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation
https://www.fireeye.com/current-threats/apt-groups/rpt-apt41.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/h/apt41-perfects-code-signing-abuse.html
Earth Freybug Uses UNAPIMON for Unhooking Critical APIs
https://www.trendmicro.com/en_us/research/24/e/earth-freybug.html
APT41 Exploits F5 BIG-IP for Persistent Access
https://www.fortinet.com/blog/threat-research/apt41-analysis
CISA Alert: APT41 Targeting Network Edge Devices
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation
https://www.cybereason.com/blog/operation-cuckoobees-cybereason-uncovers-massive-chinese-intellectual-property-theft-operation
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/d/apt41-perfects-code-signing-abuse.html
APT41 Double Trouble - Mandiant Summit 2024
https://www.mandiant.com/resources/reports/apt41-double-trouble
APT41 Deploys PlugX and KEYPLUG Variants - Trend Micro 2024
https://www.trendmicro.com/en_us/research/24/b/apt41-deploying-plugx-and-keyplug-variants.html
APT41 Targeting Citrix NetScaler Devices
https://www.mandiant.com/resources/blog/apt41-citrix-netscaler-devices
APT41 Compromises Networks Via F5 BIG-IP Vulnerability
https://www.sentinelone.com/labs/apt41-compromises-networks-via-f5-big-ip-vulnerability/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/h/apt41-perfects-code-signing-abuse-to-escalate-supply-chain-attac.html
APT41 World Tour 2021 on a Tight Schedule - Sentinelone
https://www.sentinelone.com/labs/apt41-world-tour-2021-on-a-tight-schedule/
APT41's Double Threat: Espionage and Ransomware in 2024
https://www.mandiant.com/resources/blog/apt41-dual-espionage-ransomware
Earth Freybug: APT41's Latest Campaign Targets Telecom and Government
https://www.trendmicro.com/en_us/research/24/c/earth-freybug-apt41-campaign.html
APT41 Compromises Networks in Multiple Industry Sectors
https://www.mandiant.com/resources/blog/apt41-compromises-networks
APT41: Double Dragon APT
https://www.sentinelone.com/labs/apt41-double-dragon-apt/
Earth Baku: An APT Group Targeting Indo-Pacific Countries
https://www.trendmicro.com/en_us/research/24/a/earth-baku-an-apt-group-targeting-indo-pacific-countries.html
Earth Longzhi Returns: APT41 Targets Taiwan
https://www.trendmicro.com/en_us/research/24/e/earth-longzhi-apt41.html
USCYBERCOM Tweet on APT41 Malware Samples
https://twitter.com/CNMF_VirusAlert/status/1319676745969446913
Seven International Cyber Defendants, Including Apt41 Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally
https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer
Double Dragon: APT41, a dual espionage and cyber crime operation - FireEye
https://www.mandiant.com/resources/reports/apt41-double-dragon
Chinese APT Groups Spotted Targeting Key Cambodian Organizations - Recorded Future
https://www.recordedfuture.com/chinese-apt-groups-target-cambodian-organizations
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf
Google Threat Intelligence Group: APT41 Perfects Code Signing Abuse
https://cloud.google.com/blog/topics/threat-intelligence/apt41-perfects-code-signing-abuse
CISA Alert: APT Actors Exploit Multiple Vulnerabilities
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a
Chinese APT Groups Target India and Hong Kong Using New DUSTTRAP Malware
https://www.recordedfuture.com/chinese-apt-groups-target-india-hong-kong-using-new-dusttrap
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-certificate-abuse
Chinese Espionage Group APT41 Likely Compromised Taiwanese Government-Affiliated Institute
https://www.mandiant.com/resources/blog/chinese-espionage-group-apt41
Double Dragon APT41, a dual espionage and cyber crime operation
https://content.fireeye.com/apt-41/rpt-apt41
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks - Trend Micro
https://www.trendmicro.com/en_us/research/23/l/apt41-perfects-code-signing-abuse.html
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-perfects-code-signing-abuse
APT41 Perfects Code Signing Abuse - Sophos
https://news.sophos.com/en-us/2024/08/20/apt41-perfects-code-signing-abuse/
APT41 Exploits CVE-2024-23113 in FortiOS
https://www.mandiant.com/resources/blog/apt41-fortios-stealth-vector
Chinese APT Group APT41 Targeting Security Appliances
https://www.mandiant.com/resources/blog/chinese-apt-group-apt41-targeting-security-appliances
APT41 Compromises U.S. State Government Network via CVE-2023-46747
https://www.mandiant.com/resources/blog/apt41-us-state-government
APT41 Perfects Code Signing Abuse
https://www.sentinelone.com/labs/apt41-perfects-code-signing-abuse-with-new-stealthvector-campaign/
APT41 Leverages KEYPLUG Malware in Global Intrusions
https://www.mandiant.com/resources/blog/apt41-keyplug-malware
APT41 World Tour 2021 on a tight schedule
https://www.group-ib.com/blog/apt41-world-tour-2021/
China-nexus Cyber Espionage Campaigns Target South Asian Government
https://www.sentinelone.com/labs/china-nexus-espionage-campaigns-target-south-asian-government/
Chinese APT Groups Observed Exploiting Zero-Day Vulnerabilities
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation
https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
Chinese APT Groups Targeting East and Southeast Asian Government and Critical Technology Industries - Mandiant
https://www.mandiant.com/resources/blog/chinese-apt-groups-target-east-southeast-asian-government-critical-technology
Chinese APT Groups Targeting East Asian and European Organizations
https://www.sentinelone.com/labs/chinese-apt-groups-target-southeast-asian-government-institutions/
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups/apt-groups-double-dragon.html
MESSAGETAP: Who's Reading Your Text Messages?
https://www.mandiant.com/resources/blog/messagetap-who-is-reading-your-text-messages
Double Dragon: APT41, a dual espionage and cyber crime operation
https://cloud.google.com/blog/topics/threat-intelligence/apt41-dual-espionage-and-cyber-crime-operation
Operation CuckooBees: Deep-Dive into Stealthy Cyrus APT41 Tradecraft - Cybereason
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-apt41-tradecraft
Chinese APT Groups Quickly Weaponize Zero-Day Vulnerabilities - Mandiant
https://www.mandiant.com/resources/blog/chinese-groups-exploit-ivanti-zero-day
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-supply-chain
KEYPLUG Backdoor Used by APT41 in Global Intrusion Campaign
https://www.trendmicro.com/en_us/research/23/d/earth-longzhi-apt41-keyplug.html
APT41: A Dual Espionage and Cyber Crime Operation
https://www.fireeye.com/current-threats/apt-groups.html#apt41
Chinese APT Groups Targeting Asian Gambling Sector
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-asian-gambling-sector.html
Analyzing UNC5221 Activity Exploiting CVE-2024-23113
https://www.mandiant.com/resources/blog/analyzing-unc5221-fortinet-exploitation
Chinese APT Groups Targeting Southeast Asian Government Institutions
https://www.trendmicro.com/en_us/research/23/k/chinese-apt-groups-targeting-southeast-asian-government-institut.html
Operation CuckooBees: Deep-Dive into Stealthy Cyberespionage
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-cyberespionage
Chinese APT Groups Targeting East and Southeast Asia
https://www.trendmicro.com/en_us/research/23/e/chinese-apt-groups-target-southeast-asian-government-entities.html
Chinese APT Groups Target Southeast Asian Government Institutions
https://www.mandiant.com/resources/blog/chinese-apt-groups-target-southeast-asian-government
Analyzing DUSTPAN and DUSTTRAP Malware Used by APT41
https://www.mandiant.com/resources/blog/analyzing-dustpan-dusttrap-malware-apt41
Double Dragon APT41 and the Digital Supply Chain
https://www.mandiant.com/resources/blog/apt41-digital-supply-chain
Double Trouble: APT41's Dual Operations - Mandiant M-Trends 2024
https://www.mandiant.com/m-trends
APT41 Exploits CVE-2024-23113 in Ivanti Connect Secure - Google TAG
https://blog.google/threat-analysis-group/apt41-compromises-networks-via-ivanti-connect-secure-vpn/
APT41 Compromises Networks via F5 BIG-IP Vulnerability
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-f5-big-ip
Double Trouble: APT41's Dual Operation Model
https://www.sentinelone.com/labs/apt41-double-dragon/
APT41 Leverages Google Command and Control in Recent Attacks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-google-command-control
Chinese APT Groups Rapidly Exploit New Zero-Days - Mandiant 2023
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-zero-days
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.group-ib.com/blog/apt41/
APT41 Likely Compromised Taiwanese Government-Affiliated Research Institute with ShadowPad and Cobalt Strike
https://www.trendmicro.com/en_us/research/23/h/apt41-likely-compromised-taiwanese-research-institute-with-shadowpad-cobaltstrike.html
KEYPLUG Backdoor Used by APT41
https://www.trendmicro.com/en_us/research/23/a/apt41-earth-longzhi.html