APT41

Modular backdoor platform that was initially deployed via supply chain attack on NetSarang software. Features plugin-based architecture with encrypted C2 using custom DNS tunneling.

Signature rootkit-enabled backdoor shared across multiple Chinese APT groups. Provides persistent access with kernel-level capabilities for hiding processes and network connections.

Modular backdoor loaded via DLL side-loading. Supports keylogging, screen capture, file management, and loading additional plugins from C2 servers.

Versatile RAT shared across Chinese APT groups. Uses DLL side-loading for execution and supports HTTP/DNS/TCP C2 with encrypted communications.

Cross-platform (Windows/Linux) backdoor using WebSocket and custom TCP protocols for C2. Used in attacks against telecommunications and government sectors.

Downloader/launcher that deploys secondary payloads. Uses living-off-the-land binaries and DLL side-loading to maintain stealth during initial compromise.

In-memory dropper that loads encrypted payloads directly into process memory. Used in conjunction with DUSTTRAP for multi-stage deployment.

Passive backdoor for Linux servers that listens on existing network sockets. Extremely difficult to detect as it doesn't create new network connections.

Extensively used for post-exploitation in both espionage and financially motivated operations. Custom loaders deployed via supply chain or spear-phishing vectors.

Lightweight web shell (4KB) providing remote command execution on compromised web servers. Used for initial foothold maintenance and file management.

Used for credential extraction and Kerberos ticket manipulation during lateral movement phases in both espionage and cybercrime operations.

Python framework used for SMB relay attacks, remote execution via wmiexec/smbexec, and credential extraction via secretsdump.

Used for reconnaissance, downloading secondary payloads, disabling security controls, and executing in-memory malware to avoid disk-based detection.

Windows utility abused for downloading payloads from C2 servers and decoding Base64-encoded malware during multi-stage infection chains.

Compromised CCleaner v5.33 build environment in 2017 to distribute ShadowPad backdoor to 2.27 million users. One of the largest software supply chain attacks.

FreeBSD backdoor discovered targeting Citrix ADC/Gateway appliances. Demonstrates APT41's capability to target non-Windows network infrastructure.

Backdoor delivering Cobalt Strike BEACON payloads

Modular backdoor with support for proxy and file operations

Backdoor with kernel driver component for persistence

SMS interception tool targeting telecom infrastructure

Backdoor deployed through compromised software supply chains

UEFI firmware bootkit for stealth and persistence