APT41
Also known as: Double Dragon, BARIUM, Brass Typhoon, Wicked Panda, Winnti, LEAD, Red Kelpie, Earth Baku, Wicked Spider, Bronze Atlas, HOODOO, RedGolf, MISSION2025, UNC5221, Blackfly, Grayfly, Earth Freybug, Earth Longzhi, SparklingGoblin, UNIT2025, Leopard Typhoon
MITRE ATT&CK Techniques
(74)Other
T1195.002
T1574.001
T1574.002
T1071.001
T1588.002
T1583.001
T1053.005
T1055.001
T1055.012
T1057
T1070.004
T1112
T1135
T1204.002
T1518.001
T1543.003
T1546.003
T1550.002
T1560.001
T1562.001
T1569.002
T1078.003
T1091
T1199
T1210
T1505.003
T1136.001
T1218.011
T1071.004
T1594
T1595.002
T1059.004
T1132.001
T1132.002
T1537
T1102.002
T1498
T1584.004
T1207
T1556.004
T1552.001
T1606.002
Initial Access
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Execution
Defense Evasion
Process Injection
Inject code into running processes to evade defenses and elevate privileges.
Obfuscated Files or Information
Encrypt, encode, or obfuscate payloads and data to evade detection.
Deobfuscate/Decode Files or Information
Decode or deobfuscate data and files that were previously hidden or encrypted.
Masquerading
Disguise malicious artifacts by manipulating names or locations to appear legitimate.
Collection
Exfiltration
Discovery
Lateral Movement
Privilege Escalation
Command and Control
Ingress Tool Transfer
Download additional tools or payloads from an external system.
Protocol Tunneling
Tunnel network traffic through an existing protocol to avoid detection.
Proxy
Route C2 traffic through intermediary proxies to obscure the source.
Remote Access Software
Use legitimate remote access tools like TeamViewer or AnyDesk for C2.
Impact
Tools & Malware
(141)ShadowPad
Modular backdoor platform that was initially deployed via supply chain attack on NetSarang software. Features plugin-based architecture with encrypted C2 using custom DNS tunneling.
Winnti
Signature rootkit-enabled backdoor shared across multiple Chinese APT groups. Provides persistent access with kernel-level capabilities for hiding processes and network connections.
POISONPLUG
Modular backdoor loaded via DLL side-loading. Supports keylogging, screen capture, file management, and loading additional plugins from C2 servers.
PlugX
Versatile RAT shared across Chinese APT groups. Uses DLL side-loading for execution and supports HTTP/DNS/TCP C2 with encrypted communications.
KeyPlug
Cross-platform (Windows/Linux) backdoor using WebSocket and custom TCP protocols for C2. Used in attacks against telecommunications and government sectors.
DEADEYE
Downloader/launcher that deploys secondary payloads. Uses living-off-the-land binaries and DLL side-loading to maintain stealth during initial compromise.
DUSTPAN
In-memory dropper that loads encrypted payloads directly into process memory. Used in conjunction with DUSTTRAP for multi-stage deployment.
LOWKEY
Passive backdoor for Linux servers that listens on existing network sockets. Extremely difficult to detect as it doesn't create new network connections.
Cobalt Strike
Extensively used for post-exploitation in both espionage and financially motivated operations. Custom loaders deployed via supply chain or spear-phishing vectors.
China Chopper
Lightweight web shell (4KB) providing remote command execution on compromised web servers. Used for initial foothold maintenance and file management.
Mimikatz
Used for credential extraction and Kerberos ticket manipulation during lateral movement phases in both espionage and cybercrime operations.
Impacket
Python framework used for SMB relay attacks, remote execution via wmiexec/smbexec, and credential extraction via secretsdump.
PowerShell
Used for reconnaissance, downloading secondary payloads, disabling security controls, and executing in-memory malware to avoid disk-based detection.
certutil
Windows utility abused for downloading payloads from C2 servers and decoding Base64-encoded malware during multi-stage infection chains.
CCleaner (Supply Chain)
Compromised CCleaner v5.33 build environment in 2017 to distribute ShadowPad backdoor to 2.27 million users. One of the largest software supply chain attacks.
Speculoos
FreeBSD backdoor discovered targeting Citrix ADC/Gateway appliances. Demonstrates APT41's capability to target non-Windows network infrastructure.
UPPERCUT
Backdoor delivering Cobalt Strike BEACON payloads
CROSSWALK
Modular backdoor with support for proxy and file operations
HIGHNOON
Backdoor with kernel driver component for persistence
MESSAGETAP
SMS interception tool targeting telecom infrastructure
StealthVector
Backdoor deployed through compromised software supply chains
MoonBounce
UEFI firmware bootkit for stealth and persistence
SPEEDPICK
Lightweight backdoor for remote access and reconnaissance
BEACON
Cobalt Strike payload used for post-exploitation
MoonWalk
Loader and backdoor used to deploy additional malware
StealthMutant
Advanced backdoor variant evolved from StealthVector
ColunmTK
Backdoor used in targeted espionage campaigns
DUSTTRAP
Backdoor used for reconnaissance and lateral movement
TIDYELF
Linux malware variant targeting ESXi hypervisors
DodgeBox
Exploit framework targeting edge devices and network appliances
GOSPIDER
Web shell and backdoor used for persistence on compromised web servers
SPARKLOAD
Loader component used to decrypt and execute additional payloads
HOMEUNIX
Linux-based backdoor for compromised systems
ZROK
Open-source tunneling tool abused for command and control communications
SPEAKUP
Linux backdoor targeting cloud environments
Acehash
Credential harvesting tool targeting authentication credentials
CHECKVIRUS
Backdoor used for reconnaissance and command execution on compromised systems
SPEEDRUN
Custom backdoor used for maintaining persistent access to compromised systems
SOREFANG
Memory-only dropper malware used in APT41 campaigns
BADPOTATO
Privilege escalation tool leveraging Windows token manipulation
MISTBOARD
Modular malware framework used for persistent access and data exfiltration
ANTSWORD
Web-based backdoor and webshell management tool used for maintaining persistence on compromised web servers
DeepData
Data collection and exfiltration framework deployed in targeted espionage operations
HOPLIGHT
Backdoor with remote access capabilities
BADFLICK
Backdoor malware used for maintaining access and executing commands
WATERSLIDE
Web shell backdoor deployed on compromised servers for persistent access
MISTCLOAK
Lightweight backdoor for initial access and reconnaissance
DeadBolt
Shellcode loader used to execute additional malware stages
RCLOADER
Remote access tool loader used to deploy secondary payloads
WISPRIDE
Modular backdoor with file manipulation and command execution capabilities
POOLRAT
Remote access trojan deployed by APT41 for persistent access and command execution
LIGHTSHOW
Lightweight backdoor for command execution and data exfiltration
SLEEPYHEAD
Malware variant deployed by APT41 for persistent access to compromised systems
SOGU
Remote access trojan used for command and control operations
SQLULDR2
Legitimate Oracle database tool abused by APT41 for data exfiltration from compromised databases
PHOTO
DLL backdoor deployed by APT41 with capabilities for file operations and command execution
TAILPIPE
Passive backdoor leveraged by APT41 that monitors network traffic for specific triggers to activate
ZONEDETECT
Tool used to detect security products and virtual machine environments before deploying additional malware
LOVEBUG
Custom backdoor used in APT41 operations for command and control
TONEINS
Second-stage backdoor providing remote access and file manipulation capabilities
TONESHELL
Backdoor using DNS tunneling for command and control communications
SQLMAGGIE
SQL-based backdoor for persistence in Microsoft SQL Server environments
SEASALT
Backdoor used to maintain persistent access on compromised systems
SNAPMYAI
Remote access trojan deployed via malicious PyPI packages targeting AI/ML developers
GOODOR
Go-based backdoor used by APT41 for initial access and establishing persistence on compromised systems
ECIA
Custom loader used to deploy second-stage payloads while evading detection
RAMBUTAN
Python-based backdoor used for reconnaissance and data exfiltration operations
CrowdStrike
Legitimate security software that APT41 has been observed disabling or removing to evade detection
WINNKIT
Kernel-mode rootkit used for defense evasion and maintaining persistence
CHEERSCRYPT
Ransomware variant deployed by APT41 in operations blending financial motivation with espionage
CHINACHOP
Web shell used for maintaining access to compromised web servers
TROJANIZED Collab Strike
Weaponized version of Cobalt Strike with modified configurations
CroxLoader
Multi-stage loader used to deploy Cobalt Strike and other post-exploitation tools
FISHMASTER
Modular backdoor with extensive capabilities for espionage operations
RAPIDPULSE
Backdoor leveraging Google Drive for command and control communications
WIDETONE
Backdoor malware used for persistent access and lateral movement
GALLIUM Toolset
Collection of custom tools for credential theft and lateral movement
BLINDINGCAN
Remote access trojan with capabilities for command execution and data exfiltration
HARDRAIN
Second-stage backdoor with capabilities for file operations and command execution
BRONZE STARLIGHT Ransomware
Various ransomware families deployed for financial gain and potential false flag operations
BUSHWALK
Passive backdoor that listens for incoming connections on compromised systems
WATERFALL
Backdoor used for command and control communications
SPIRITSPY
Android surveillance tool with capabilities for location tracking, call recording, and data exfiltration
EVILSUN
Custom exploit used by APT41 targeting ManageEngine vulnerabilities
TOUGHCOOKIE
Variant of DOUBLEPULSAR backdoor used for remote access
CLOUDYOMEGA
Web shell variant used for maintaining access to compromised web servers
WINTERLOVE
Multi-stage malware loader used to decrypt and execute additional payloads
ACIDPOUR
Data wiper malware deployed in targeted operations
SPEEDPIG
Custom backdoor deployed for persistent remote access
Acunetix
Legitimate web vulnerability scanner repurposed for reconnaissance
BLUEBEAM
Web shell deployed on compromised edge devices for persistent access
SALTWATER
Credential harvesting implant targeting web applications and email systems
POTROAST
Second-stage loader used to deliver additional payloads
EVILFLOWER
Custom backdoor used for command execution and lateral movement in APT41 operations
PERFCTL
Linux backdoor used for cryptocurrency mining and persistence on compromised systems
YAKSHAVER
Custom loader component used in multi-stage infection chains
FINGERPICK
Backdoor capable of executing commands and exfiltrating data
EVILSHIM
Application shim-based persistence mechanism used to establish backdoor access
SPEEDBOAT
Lightweight backdoor used for reconnaissance and lateral movement
SPEEDRUSH
Backdoor used in campaigns exploiting Barracuda ESG vulnerability, enables file operations and command execution
CHAINLINE
Modular malware loader used to deploy additional payloads in multi-stage infections
MISTYVEIL
Custom loader used to decrypt and execute payloads in memory
SEASPY
Persistence backdoor used in Barracuda ESG compromise campaigns
Megumin
Deployment framework used to deliver malware and exploits to compromised systems
MIXBOX
Modular backdoor with credential theft and lateral movement capabilities
STEAMBOAT
Shellcode-based backdoor for command execution
SCRUBCRYPT
Encrypted loader component used to decrypt and execute subsequent stage payloads
Meterpreter
Metasploit payload used for command and control and lateral movement
SPEEDSTER
Remote access trojan deployed for post-exploitation and lateral movement
SAMRID
Multi-stage backdoor that establishes persistent access on compromised systems
FunnySwitch
Backdoor variant used in recent campaigns for initial access and reconnaissance
FRESHAIR
Backdoor deployed via compromised edge devices
DUSTCLOUD
Dropper used to deliver additional payloads
QUICKPULSE
Web shell deployed on compromised servers for persistent access
ZIPLINE
Passive backdoor activated by network packets
TINYSHELL
Lightweight backdoor used for persistent access
HARDPULSE
HyperBro variant backdoor deployed via DLL side-loading techniques
BIOPASS RAT
Python-based remote access trojan with keylogging and screenshotting capabilities
Clambling
Modular backdoor with extensive reconnaissance and data collection capabilities
TABLEFLIP
Kernel-mode rootkit used for stealth and persistence
SPEEDPRO
Backdoor used for remote access and command execution
LOCKFILE
Ransomware deployed for financial gain using intermittent encryption
SLOWPULSE
Backdoor deployed via exploitation of network edge devices, particularly Fortinet and Sophos firewalls
TAILCALL
Proxy backdoor used for command and control communications through compromised network devices
HIPSDAEMON
Linux backdoor used for persistence and command execution on compromised systems
WINELOADER
Loader used to deploy additional malware stages in compromised environments
WARPRISM
JavaScript-based backdoor used for reconnaissance and payload delivery
REDFLARE
Custom loader used in supply chain attacks to deploy additional malware
CRACKSHOT
Modular backdoor deployed by APT41 with capabilities for command execution and data theft
SPELL
Lightweight backdoor used for maintaining persistent access
POOLSIDE
Kernel-mode driver rootkit used for defense evasion and maintaining stealth
NIGHTDOOR
Backdoor deployed for persistent access with file management capabilities
BLOODHOUND
Active Directory reconnaissance tool
CHINACHOPPER
Widely-used webshell for remote access to compromised web servers
FOXGRABBER
Credential stealer targeting browser data and stored credentials
PLAINTEE
Dropper malware used to deploy second-stage payloads
ROOTSAW
Loader used to decrypt and execute additional payloads in memory
SOULSEARCH
Passive backdoor that listens for magic packets to activate
MKTZYBH
Web shell variant deployed on compromised servers for persistent access
BEARWALK
Malware loader used to deploy additional payloads
MJOLNIR
Remote access trojan with comprehensive system reconnaissance and data exfiltration capabilities
Indicators of Compromise
(207)| Type | Value |
|---|---|
| domain | ns1[.]clofrfrede[.]com |
| domain | infestexe[.]com |
| ip | 103[.]230[.]15[.]130 |
| ip | 149[.]28[.]78[.]89 |
| hash | 7966c2c546b71e800cddd2a6d3a8b0e1 |
| hash | 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360 |
| hash | 65da1a9026cf171a5a7779bc5ee45fb1 |
| hash | 39a46d7f1ef9b9a5e40860cd5f646b9d |
| url | hxxps[[://]]www[.]googleapis[.]com/calendar/v3/calendars/ff57964096cadc1a8733cf566b41c9528c89d30edec86326c723932c1e79ebf0@group[.]calendar[.]google[.]com/events |
| ip | 43[.]99[.]48[.]196 |
| ip | 146[.]70[.]87[.]67 |
| domain | ai[.]qianxing[.]co |
| domain | ns1[.]a1iyun[.]top |
| domain | ai[.]aliyuncs[.]help |
| url | tkshopqd[.]s3[.]amazonaws[.]com |
| domain | cdn[.]dellcdn[.]com |
| domain | update[.]centos-packages[.]com |
| ip | 103[.]27[.]109[.]217 |
| ip | 45[.]142[.]212[.]61 |
| hash | a4e9b7f76c2c7f1e8b3d4c5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c |
| domain | checkin[.]travelsanignacio[.]com |
| domain | cdn[.]oracleapi[.]org |
| ip | 45[.]77[.]253[.]135 |
| hash | 5d8c4b2d8f8f0e4f5c6e8a7c9d1f2e4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e |
| domain | webserver[.]selfip[.]biz |
| domain | cloudflare-api[.]com |
| domain | dns-update[.]com |
| hash | d42d9f8c2e6f8b5a4c3e1a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d |
| domain | www[.]chatgptapp[.]shop |
| domain | www[.]googleclouds[.]top |
| hash | c948ae14761095e4d76b55d9de86412258be7afd |
| ip | 45[.]77[.]243[.]211 |
| domain | checkin[.]travelsinfo[.]net |
| domain | update[.]centosupdates[.]com |
| ip | 154[.]223[.]129[.]227 |
| hash | b8a61adfe5f0452b57b4f9f62e8a5b8c8d6e9c5f1a2b3c4d5e6f7a8b9c0d1e2f |
| domain | checkin[.]travelsolutions[.]com |
| domain | cdn[.]chatgptapp[.]chat |
| ip | 45[.]77[.]170[.]235 |
| hash | 8b8e4c9c8c6f4e3f5a7d9c8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a |
| domain | webserver[.]microsofts[.]org |
| domain | update[.]iaaca[.]org |
| hash | b8c6d364cc2024a0b6d6d0fc9fcbf7d4 |
| ip | 45[.]77[.]36[.]243 |
| domain | checkin[.]repair-dns[.]com |
| domain | aws[.]amazoawss[.]com |
| ip | 45[.]77[.]243[.]133 |
| hash | e5b9a5d36b7e1b8f7a0c8e6f9d1a3b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a |
| domain | www[.]chatgptc[.]com |
| domain | smtp[.]outlookmails[.]com |
| ip | 45[.]77[.]21[.]211 |
| hash | 3c5c3e2c6c6c0b6b8f8f8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b |
| domain | webserver-globa1-check45632[[.]]com |
| domain | globalnetworkissues[[.]]com |
| ip | 45[.]32[.]13[.]180 |
| hash | b7f4d37f8f6a8f8e0e0f1d3c5a3b2e1f9c8d7a6b5c4d3e2f1a0b9c8d7e6f5a4b |
| domain | cdn[.]oracleaws[.]com |
| domain | smtp[.]dellmail[.]com |
| ip | 104[.]244[.]79[.]94 |
| hash | b7f4b7f9e5d5c5e5a5f5e5d5c5e5a5f5 |
| domain | download[.]windowsupdate[.]corp |
| domain | cdn[.]microsofts[.]org |
| ip | 45[.]77[.]243[.]15 |
| hash | b8c5b8f8f8f7b5e7d7f8e8d8c8b8a8f8e8d8c8b8a8f8e8d8c8b8a8f8e8d8c8b8 |
| domain | webmail[.]oracleservice[.]top |
| domain | update[.]driversolutions[.]net |
| hash | d42a3c6c4f6f5a8f5e9e2a0c7b8d9e6f3c4a5b7c8d9e0f1a2b3c4d5e6f7a8b9c |
| domain | update[.]iaacorporate[.]com |
| ip | 45[.]77[.]183[.]168 |
| hash | b8c5c59b6e1d5f0e7d5c0a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d |
| domain | webmail[.]joyobserve[.]com |
| domain | cdn[.]chatgptc[.]com |
| ip | 45[.]61[.]136[.]47 |
| hash | b82f7f02b0e8f3f6e7b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7 |
| domain | passport[.]livehost[.]live |
| domain | webmail[.]newsblog[.]club |
| hash | 8c8b0e4c7b79b5e5c3e4c5c8f1f1a8d5e0c7f8c5f5b5e7b8f0c7e5f8d5c7f8e5 |
| domain | www[.]carcarrental[[.]]com |
| domain | update[.]cloudjscdn[[.]]com |
| hash | e5b6c9d8f7a3b4c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8 |
| domain | cloud-security-net[.]com |
| hash | 8f6e2c1f8b5d4a3e9c7f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d |
| domain | cdn[.]oraclegovcloud[.]com |
| domain | verify[.]globaltrustassoc[.]com |
| hash | b4b9c8e1f3e7d5c6a2f8e9d7c5b3a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4 |
| domain | cdn[.]webanalytic[.]online |
| domain | update[.]versionchecker[.]net |
| hash | 8b9d8389e3b3d6f7d3e6c4a9f2e8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0 |
| domain | webmail[.]oarnational[.]com |
| domain | cdn[.]altimiterasw[.]com |
| hash | 8b3c4d9b6f2e1a7c5d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c |
| domain | ssl[.]arkouthrie[.]com |
| domain | global[.]aetherinc[.]com |
| hash | 8b5d4b7d2c3a1e6f9c4d3a2b1e5f6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a |
| domain | cdn[.]chatgptapi[.]org |
| hash | 5d6b6b3d3f5e5f5e8f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e |
| domain | webserver[.]homeunix[.]org |
| domain | www[.]chatconnecting[.]com |
| hash | 8b9f6a8e3c5e4f2a1d7b9c0e5f8a3b6c9d2e5f8a1b4c7d0e3f6a9b2c5d8e1f4a |
| domain | webmail[.]baggybill[.]com |
| domain | update[.]iaac[.]cloud |
| ip | 107[.]148[.]163[.]163 |
| domain | cdn[.]chatgptapp[.]shop |
| domain | webmail[.]microtechglobal[.]com |
| hash | 8b3c3d7f4e5a6b2c1d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c |
| domain | webserver-glb[.]com |
| domain | cdn-edge-akamai[.]com |
| ip | 45[.]76[.]179[.]163 |
| domain | microsoftdefenderupdate[.]com |
| domain | windowsprotection[.]net |
| hash | 5262cb9791df50fafbde0be3c7d4a66d7b8f5f1e8d8f4c7b3e7e8c0e9f2a1b3c |
| domain | mailserveropconfigservice[.]com |
| domain | cdn-office365management[.]com |
| ip | 154[.]223[.]149[.]62 |
| hash | c9b5d49eb5063e2f69f3d4c18e6f8c5e5f5a7b6c3d4e5f6a7b8c9d0e1f2a3b4c |
| domain | cloudflare-resolve[.]com |
| domain | microsoftdefence[.]com |
| hash | b9f2a1287b0d69b8d506e2c8e4c9a9e8f5a4c6b3e2d1a0f9e8d7c6b5a4e3d2c1 |
| domain | www[.]chatgptapp[.]org |
| domain | microsoftdefenderportal[.]com |
| hash | 5262cb9791af34c85f9e3fd636f1e6d1b5a8c7f90f40b0b1f3a8e3d5c6b7e8f9 |
| domain | www[.]chatgptapp[.]uk |
| domain | anydesk[.]ns01[.]info |
| hash | c74e89fd8bcf5a9c8e52be25c0c9c2e8dbce1f8e |
| ip | 45[.]77[.]36[.]17 |
| domain | loginhelper[.]net |
| domain | centreon[.]pw |
| ip | 45[.]77[.]253[.]206 |
| hash | c7a7045b7e0d7f7a3c3c5c5e5c5e5c5e5c5e5c5e5c5e5c5e5c5e5c5e5c5e5c5e |
| domain | ns1[.]mykings[.]top |
| domain | update[.]zzzzdedicated[.]com |
| ip | 185[.]220[.]101[.]71 |
| hash | 7e4e1f3c7e7e7f1f8e8e8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f |
| domain | akamaitechcloudservices[.]com |
| domain | azureonlinecloud[.]com |
| domain | update[.]livehost902[.]com |
| ip | 45[.]154[.]14[.]235 |
| hash | 8b3c3d7a1f6e2d4c5b9a8e7f6d5c4b3a2e1f0d9c8b7a6f5e4d3c2b1a0f9e8d7c |
| domain | global-office365[.]com |
| domain | microsoft-office365[.]live |
| hash | 8b8c1f8f0a6f8d8a9c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b |
| domain | win[.]syshome1[.]com |
| domain | wmi[.]syshome1[.]com |
| hash | e5b7f5e4c1e4e4a4b7e5f5e4c1e4e4a4b7e5f5e4c1e4e4a4b7e5f5e4c1e4e4a4 |
| domain | www[.]carbonxlcloud[.]com |
| domain | api[.]msidentityapp[.]com |
| hash | 8b3c9a7f5e8f2e6a9a0c3c1d5f2e9d6f8c1a3e5b7d9f1e3a5c7b9d1f3e5a7c9b |
| domain | webserver[.]dnsabr[.]com |
| domain | dns[.]dnsabr[.]com |
| ip | 45[.]63[.]62[.]109 |
| ip | 149[.]28[.]93[.]184 |
| domain | checkout[.]tonviet[.]com |
| domain | dns[.]idatalink[.]net |
| hash | 8c5b9b3b6c8f3e2a1d4f5e6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d |
| domain | cdn[.]discordapp[.]org |
| domain | pastebin[.]com |
| hash | 8e7a9a7c9f4e5b6d3c2a1f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c |
| domain | github-cdn[.]com |
| domain | cloudflare-radar[.]com |
| ip | 45[.]77[.]245[.]18 |
| hash | c726287d29a2df646c5a4cfad0c80efc9e3a3f3e8b0b8c6e7d8a9b0c1d2e3f4a |
| domain | cdn-chrome[.]com |
| domain | googletagmanager[.]eu |
| hash | 8b3c2e0c7d1f5f3a6e9b4c8d2e7f1a5b9c3d6e8f1a4b7c9d2e5f8a1b4c7d9e2f |
| domain | api[.]tiktokv[.]com |
| ip | 45[.]77[.]156[.]110 |
| hash | 2c9d7e5e5a8f3c8d6b8f0d3e4a5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c |
| domain | webmail-webmails[.]com |
| hash | e5b7f5f6b4e4c8e9b1c7a2f3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3 |
| domain | webserver[.]microsoftbook[.]com |
| domain | update[.]dragonssl[.]net |
| ip | 45[.]77[.]247[.]120 |
| hash | 5d7d5ea8e8d8b8f5c6e9a1f7a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2 |
| domain | microsoftmse[.]com |
| domain | checkin[.]applemusic[.]com |
| ip | 45[.]77[.]51[.]159 |
| hash | 8a4b7c9d6e5f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b |
| domain | cdn[.]cartilix[.]com |
| domain | opensourcing[.]net |
| ip | 45[.]77[.]253[.]137 |
| hash | 8b3c3b6b8f5e9a0e1d5c2a7f4e9b6c3d5a8f7e4c2b9d6e3a1f8c5b7e4a9d2c6f |
| domain | shop[.]dcbabc[.]com |
| domain | www[.]beddinglавав[.]com |
| ip | 45[.]77[.]253[.]82 |
| hash | 3c5c3e3a9c1b5d5e5f5c3d3b3a3c3e3a9c1b5d5e5f5c3d3b3a3c3e3a9c1b5d5e |
| domain | cdn[.]bingsearchlib[.]com |
| ip | 45[.]142[.]166[.]112 |
| hash | a3c1e6e6e8e7e4e5e6e7e8e9e0e1e2e3 |
| domain | www[.]millshospice[.]com |
| ip | 45[.]77[.]243[.]100 |
| hash | d5a6d0c5c83a5d1e8f4e7c8c3d7b8e2f1a9c6d3e4f5a6b7c8d9e0f1a2b3c4d5e |
| domain | apple-net[.]com |
| hash | 5d6b6b1a3b8f7c8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2 |
| domain | webmail[.]nsacdns[.]com |
| domain | cdn[.]chatgptapi[.]net |
| ip | 154[.]204[.]28[.]61 |
| hash | a3e8d3c7f1b2e4d5a6f7c8b9d0e1f2a3b4c5d6e7 |
| domain | api[.]amazoncom[.]cloud |
| domain | update[.]microsofts[.]cloud |
| ip | 45[.]77[.]36[.]153 |
| hash | 8b8f4d91d8b8f6c4f7e3d2a1b5c6e9f0a3b7c8d1e2f3a4b5c6d7e8f9a0b1c2d3 |
| domain | cdn-office365[.]com |
| domain | microsoftdefender[.]top |
| hash | 8b7c8b7a7c8b7c8b7c8b7a7c8b7c8b7a7c8b7c8b7a7c8b7c8b7a7c8b7c8b |
| domain | www[.]chatgptapp[.]click |
| domain | microsoftdefender[.]us |
| hash | c14da342fd842d75882bdb0130551981 |
Infrastructure
(10)| Domain / Host | Status |
|---|---|
ns1[.]clofrfrede[.]comShadowPad C2 infrastructure | offline |
infestexe[.]comCROSSWALK/DEADEYE C2 domain | offline |
103[.]230[.]15[.]130KeyPlug Linux backdoor C2 server | active |
149[.]28[.]78[.]89Infrastructure used in telecom targeting | offline |
thetavaluemetrics[.]com | active |
www[.]googleapis[.]com | ip_changed |
ai[.]qianxing[.]co | unknown |
ns1[.]a1iyun[.]top | unknown |
ai[.]aliyuncs[.]help | unknown |
tkshopqd[.]s3[.]amazonaws[.]com | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
References
(214)MITRE ATT&CK - APT41
https://attack.mitre.org/groups/G0096/
Mandiant - APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
U.S. DOJ - Seven International Cyber Defendants Charged
https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged
KEYPLUG Backdoor: APT41's Pivotal Tool for Cyber Espionage
https://www.group-ib.com/blog/apt41-keyplug/
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/blog/apt41-dual-espionage-and-cyber-crime-operation
Chinese APT41 Hackers Target Android Devices with WyrmSpy, DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-android.html
MoonBounce: the dark side of UEFI firmware
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
CISA Alert: APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ServiceDesk Plus
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-259a
Mandiant: APT41 Has Arisen From the DUST
https://www.mandiant.com/resources/blog/apt41-arisen-from-dust
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-certificates
Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html
KEYPLUG Backdoor Used by APT41 in Recent Campaigns
https://www.mandiant.com/resources/blog/APT41-keyplug-backdoor
APT41 World Tour 2021 on a Budget
https://www.mandiant.com/resources/blog/apt41-world-tour-2021
Operation CuckooBees: Deep-Dive into Stealthy Cyberus Campaign
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-cyberus-campaign
Mark Your Calendar: APT41 Innovative Tactics - Google Cloud
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
APT41 Cyber-Espionage Campaign Targets U.S. Policy Institutions - HivePro
https://hivepro.com/threat-advisory/apt41-cyber-espionage-campaign-targets-u-s-policy-institutions/
China-Linked APT41 Hackers Target U.S. Trade Officials - The Hacker News
https://thehackernews.com/2025/09/china-linked-apt41-hackers-target-us.html
APT PROFILE – MISSION2025 - CYFIRMA
https://www.cyfirma.com/research/apt-profile-mission2025/
APT41 Targets Linux Cloud Servers With New Winnti Backdoor - GBHackers
https://gbhackers.com/new-winnti-backdoor/
Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited - Freemindtronic
https://freemindtronic.com/chrome-v8-zero-day-cve-2025-6554-active-exploit/
China-Nexus Threat Actor Exploiting Ivanti EPMM - EclecticIQ
https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/reports/apt41-double-dragon-dual-espionage-and-cyber-crime-operation
APT41 Exploits Barracuda ESG Zero-Day Vulnerability
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
CISA Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Fortinet Zero-Day Exploited by APT41
https://www.fortinet.com/blog/psirt-blogs/analysis-of-fg-ir-23-365
APT41 World Tour 2021: Earth Baku Returns
https://www.trendmicro.com/en_us/research/22/f/apt41-earth-baku-returns.html
Chinese APT Groups Targeting Ivanti Connect Secure Devices
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-ivanti-connect-secure
APT41 Perfects Code Signing Abuse - Mandiant
https://www.mandiant.com/resources/blog/apt41-perfects-code-signing-abuse
ESET APT Activity Report Q3 2023-Q2 2024
https://www.welivesecurity.com/en/eset-research/apt-activity-report-q3-2023-q2-2024/
This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/i/apt41-perfects-code-signing-abuse.html
APT41 Uses Earth Freybug Malware to Target Governments
https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html
APT41 World Wide
https://www.mandiant.com/resources/reports/apt41-world-wide
Earth Longzhi Returns: Exploiting CVE-2023-32315
https://www.trendmicro.com/en_us/research/23/j/earth-longzhi-returns.html
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups/apt-41.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.sentinelone.com/labs/apt41-perfects-code-signing-abuse-to-escalate-supply-chain-attacks/
APT41 World Tour 2021 on a NEAR Protocol
https://www.mandiant.com/resources/blog/apt41-us-state-governments
Chinese APT Groups Exploiting CVE-2023-46747 in F5 BIG-IP
https://www.mandiant.com/resources/blog/china-nexus-espionage-f5-big-ip
APT41 Compromises Networks via Advanced Custom Malware
https://www.trendmicro.com/en_us/research/24/a/earth-freybug.html
Chinese Cyberespionage Group APT41 Targets Gambling Industry
https://www.trendmicro.com/en_us/research/24/b/chinese-cyberespionage-group-apt41-targets-gambling-industry.html
APT41 Perfects Code Signing Abuse and Demonstrates Sophisticated Threat
https://www.trellix.com/en-us/about/newsroom/stories/research/apt41-perfects-code-signing-abuse.html
APT41: A Dual Espionage and Cyber Crime Operation - FireEye
https://www.mandiant.com/resources/reports/apt41-dual-espionage-and-cyber-crime-operation
KEYPLUG Backdoor Used by APT41
https://www.mandiant.com/resources/blog/session-hijacking-keyplug-backdoor
APT41 Compromises Networks via F5 BIG-IP Vulnerability
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-f5-vulnerability
Chinese Espionage Group APT41 Struck Hundreds of Companies
https://www.trendmicro.com/en_us/research/21/l/apt41-earth-baku-returns.html
APT41 Has Arisen From the DUST
https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust
APT41: Double Dragon APT Group Analysis
https://www.recordedfuture.com/apt41-double-dragon-apt-group
Chinese APT Groups Targeting Southeast Asian Government Institutions
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-southeast-asian-government-institut.html
Earth Freybug Uses UNAPIMON for Unhooking Critical APIs
https://www.trendmicro.com/en_us/research/24/c/earth-freybug.html
Chinese Espionage Group APT41 Strikes Again
https://www.sentinelone.com/labs/chinese-espionage-group-apt41-strikes-again/
APT41 Leverages Google Command and Control
https://www.mandiant.com/resources/blog/apt41-google-command-control
CISA Alert: APT Actors Exploiting CVE-2024-23113 in FortiOS
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a
APT41 World Tour 2021 on a Big Data Platform
https://www.trendmicro.com/en_us/research/23/c/apt41-campaign-targeting-bigdata-platform.html
Earth Longzhi Resurfaces with New Techniques and Targets
https://www.trendmicro.com/en_us/research/24/b/earth-longzhi.html
Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques
Chinese APT Groups Target Semiconductor Industry - Mandiant 2024
https://www.mandiant.com/resources/blog/chinese-groups-target-semiconductor-industry
APT41 Leverages Google Services for C2 Communication - Mandiant 2024
https://www.mandiant.com/resources/blog/apt41-google-c2
Chinese APT41 Group Compromised Telecommunications Providers to Track Individuals
https://www.fireeye.com/blog/threat-research/2019/08/apt41-targeting-telecommunications.html
APT41 Chinese Threat Group Exploiting CVE-2024-23113
https://www.mandiant.com/resources/blog/chinese-nexus-espionage-fortinet-cve-2024-23113
Chinese APT41 Hackers Target Global Orgs in Latest Espionage Attack
https://symantec-enterprise-blogs.security.com/threat-intelligence/apt41-espionage-attack-2024
Chinese Espionage Group APT41 Strikes Again: Targets Telecommunications
https://www.sentinelone.com/labs/chinese-espionage-group-apt41-strikes-again-targets-telecommunications/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/24/e/apt41-perfects-code-signing-abuse.html
APT41 World Tour 2021
https://www.fireeye.com/blog/threat-research/2021/03/apt41-initiates-global-intrusion-campaign.html
Chinese Espionage Group APT41 Strikes Gambling Sector
https://www.recordedfuture.com/chinese-group-apt41-known-for-cyber-espionage
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-abuse
Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation
https://www.fireeye.com/current-threats/apt-groups/rpt-apt41.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/h/apt41-perfects-code-signing-abuse.html
Earth Freybug Uses UNAPIMON for Unhooking Critical APIs
https://www.trendmicro.com/en_us/research/24/e/earth-freybug.html
APT41 Exploits F5 BIG-IP for Persistent Access
https://www.fortinet.com/blog/threat-research/apt41-analysis
CISA Alert: APT41 Targeting Network Edge Devices
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation
https://www.cybereason.com/blog/operation-cuckoobees-cybereason-uncovers-massive-chinese-intellectual-property-theft-operation
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/d/apt41-perfects-code-signing-abuse.html
APT41 Double Trouble - Mandiant Summit 2024
https://www.mandiant.com/resources/reports/apt41-double-trouble
APT41 Deploys PlugX and KEYPLUG Variants - Trend Micro 2024
https://www.trendmicro.com/en_us/research/24/b/apt41-deploying-plugx-and-keyplug-variants.html
APT41 Targeting Citrix NetScaler Devices
https://www.mandiant.com/resources/blog/apt41-citrix-netscaler-devices
APT41 Compromises Networks Via F5 BIG-IP Vulnerability
https://www.sentinelone.com/labs/apt41-compromises-networks-via-f5-big-ip-vulnerability/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/h/apt41-perfects-code-signing-abuse-to-escalate-supply-chain-attac.html
APT41 World Tour 2021 on a Tight Schedule - Sentinelone
https://www.sentinelone.com/labs/apt41-world-tour-2021-on-a-tight-schedule/
APT41's Double Threat: Espionage and Ransomware in 2024
https://www.mandiant.com/resources/blog/apt41-dual-espionage-ransomware
Earth Freybug: APT41's Latest Campaign Targets Telecom and Government
https://www.trendmicro.com/en_us/research/24/c/earth-freybug-apt41-campaign.html
APT41 Compromises Networks in Multiple Industry Sectors
https://www.mandiant.com/resources/blog/apt41-compromises-networks
APT41: Double Dragon APT
https://www.sentinelone.com/labs/apt41-double-dragon-apt/
Earth Baku: An APT Group Targeting Indo-Pacific Countries
https://www.trendmicro.com/en_us/research/24/a/earth-baku-an-apt-group-targeting-indo-pacific-countries.html
Earth Longzhi Returns: APT41 Targets Taiwan
https://www.trendmicro.com/en_us/research/24/e/earth-longzhi-apt41.html
USCYBERCOM Tweet on APT41 Malware Samples
https://twitter.com/CNMF_VirusAlert/status/1319676745969446913
Seven International Cyber Defendants, Including Apt41 Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally
https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer
Double Dragon: APT41, a dual espionage and cyber crime operation - FireEye
https://www.mandiant.com/resources/reports/apt41-double-dragon
Chinese APT Groups Spotted Targeting Key Cambodian Organizations - Recorded Future
https://www.recordedfuture.com/chinese-apt-groups-target-cambodian-organizations
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf
Google Threat Intelligence Group: APT41 Perfects Code Signing Abuse
https://cloud.google.com/blog/topics/threat-intelligence/apt41-perfects-code-signing-abuse
CISA Alert: APT Actors Exploit Multiple Vulnerabilities
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a
Chinese APT Groups Target India and Hong Kong Using New DUSTTRAP Malware
https://www.recordedfuture.com/chinese-apt-groups-target-india-hong-kong-using-new-dusttrap
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-certificate-abuse
Chinese Espionage Group APT41 Likely Compromised Taiwanese Government-Affiliated Institute
https://www.mandiant.com/resources/blog/chinese-espionage-group-apt41
Double Dragon APT41, a dual espionage and cyber crime operation
https://content.fireeye.com/apt-41/rpt-apt41
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks - Trend Micro
https://www.trendmicro.com/en_us/research/23/l/apt41-perfects-code-signing-abuse.html
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-perfects-code-signing-abuse
APT41 Perfects Code Signing Abuse - Sophos
https://news.sophos.com/en-us/2024/08/20/apt41-perfects-code-signing-abuse/
APT41 Exploits CVE-2024-23113 in FortiOS
https://www.mandiant.com/resources/blog/apt41-fortios-stealth-vector
Chinese APT Group APT41 Targeting Security Appliances
https://www.mandiant.com/resources/blog/chinese-apt-group-apt41-targeting-security-appliances
APT41 Compromises U.S. State Government Network via CVE-2023-46747
https://www.mandiant.com/resources/blog/apt41-us-state-government
APT41 Perfects Code Signing Abuse
https://www.sentinelone.com/labs/apt41-perfects-code-signing-abuse-with-new-stealthvector-campaign/
APT41 Leverages KEYPLUG Malware in Global Intrusions
https://www.mandiant.com/resources/blog/apt41-keyplug-malware
APT41 World Tour 2021 on a tight schedule
https://www.group-ib.com/blog/apt41-world-tour-2021/
China-nexus Cyber Espionage Campaigns Target South Asian Government
https://www.sentinelone.com/labs/china-nexus-espionage-campaigns-target-south-asian-government/
Chinese APT Groups Observed Exploiting Zero-Day Vulnerabilities
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation
https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
Chinese APT Groups Targeting East and Southeast Asian Government and Critical Technology Industries - Mandiant
https://www.mandiant.com/resources/blog/chinese-apt-groups-target-east-southeast-asian-government-critical-technology
Chinese APT Groups Targeting East Asian and European Organizations
https://www.sentinelone.com/labs/chinese-apt-groups-target-southeast-asian-government-institutions/
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/current-threats/apt-groups/apt-groups-double-dragon.html
MESSAGETAP: Who's Reading Your Text Messages?
https://www.mandiant.com/resources/blog/messagetap-who-is-reading-your-text-messages
Double Dragon: APT41, a dual espionage and cyber crime operation
https://cloud.google.com/blog/topics/threat-intelligence/apt41-dual-espionage-and-cyber-crime-operation
Operation CuckooBees: Deep-Dive into Stealthy Cyrus APT41 Tradecraft - Cybereason
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-apt41-tradecraft
Chinese APT Groups Quickly Weaponize Zero-Day Vulnerabilities - Mandiant
https://www.mandiant.com/resources/blog/chinese-groups-exploit-ivanti-zero-day
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-supply-chain
KEYPLUG Backdoor Used by APT41 in Global Intrusion Campaign
https://www.trendmicro.com/en_us/research/23/d/earth-longzhi-apt41-keyplug.html
APT41: A Dual Espionage and Cyber Crime Operation
https://www.fireeye.com/current-threats/apt-groups.html#apt41
Chinese APT Groups Targeting Asian Gambling Sector
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-asian-gambling-sector.html
Analyzing UNC5221 Activity Exploiting CVE-2024-23113
https://www.mandiant.com/resources/blog/analyzing-unc5221-fortinet-exploitation
Chinese APT Groups Targeting Southeast Asian Government Institutions
https://www.trendmicro.com/en_us/research/23/k/chinese-apt-groups-targeting-southeast-asian-government-institut.html
Operation CuckooBees: Deep-Dive into Stealthy Cyberespionage
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-cyberespionage
Chinese APT Groups Targeting East and Southeast Asia
https://www.trendmicro.com/en_us/research/23/e/chinese-apt-groups-target-southeast-asian-government-entities.html
Chinese APT Groups Target Southeast Asian Government Institutions
https://www.mandiant.com/resources/blog/chinese-apt-groups-target-southeast-asian-government
Analyzing DUSTPAN and DUSTTRAP Malware Used by APT41
https://www.mandiant.com/resources/blog/analyzing-dustpan-dusttrap-malware-apt41
Double Dragon APT41 and the Digital Supply Chain
https://www.mandiant.com/resources/blog/apt41-digital-supply-chain
Double Trouble: APT41's Dual Operations - Mandiant M-Trends 2024
https://www.mandiant.com/m-trends
APT41 Exploits CVE-2024-23113 in Ivanti Connect Secure - Google TAG
https://blog.google/threat-analysis-group/apt41-compromises-networks-via-ivanti-connect-secure-vpn/
APT41 Compromises Networks via F5 BIG-IP Vulnerability
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-f5-big-ip
Double Trouble: APT41's Dual Operation Model
https://www.sentinelone.com/labs/apt41-double-dragon/
APT41 Leverages Google Command and Control in Recent Attacks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-google-command-control
Chinese APT Groups Rapidly Exploit New Zero-Days - Mandiant 2023
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-zero-days
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.group-ib.com/blog/apt41/
APT41 Likely Compromised Taiwanese Government-Affiliated Research Institute with ShadowPad and Cobalt Strike
https://www.trendmicro.com/en_us/research/23/h/apt41-likely-compromised-taiwanese-research-institute-with-shadowpad-cobaltstrike.html
KEYPLUG Backdoor Used by APT41
https://www.trendmicro.com/en_us/research/23/a/apt41-earth-longzhi.html
APT41 Exploits CVE-2023-46747 in F5 BIG-IP
https://www.mandiant.com/resources/blog/apt41-exploits-cve-2023-46747
Chinese Espionage Operations Leveraging KEYPLUG - Mandiant
https://www.mandiant.com/resources/blog/chinese-espionage-operations-leveraging-keyplug
KEYPLUG Malware Used by APT41 in Recent Campaigns
https://www.trellix.com/en-us/about/newsroom/stories/research/apt41-keyplug-malware.html
APT41 Exploits CVE-2024-23113 Zero-Day in Ivanti Products
https://www.mandiant.com/resources/blog/suspected-apt-exploits-fortinet-zero-day
Earth Longzhi APT Group Targets Organizations in Asia
https://www.trendmicro.com/en_us/research/23/d/earth-longzhi-apt-group-targets-organizations-in-asia.html
APT41 Exploits Citrix NetScaler and Cisco ASA Zero-Days
https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
APT41 World Tour 2021: Earth Baku Returns
https://www.trendmicro.com/en_us/research/23/a/apt41-earth-baku-returns.html
APT41: A Case Study on China-Nexus Intrusion Activity
https://cloud.google.com/blog/topics/threat-intelligence/apt41-china-nexus-intrusion-activity
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/24/a/apt41-perfects-code-signing-abuse.html
KEYPLUG Backdoor Used by APT41 in Multiple Campaigns
https://www.mandiant.com/resources/blog/keyplug-china-apt-targeted-attacks
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/code-signing-certificate-cloning
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/21/h/apt41-perfects-code-signing-abuse.html
APT41 Exploits CVE-2024-23113 in FortiOS - Fortinet
https://www.fortinet.com/blog/psirt-blogs/analysis-of-fg-ir-23-423
MESSAGETAP: Who's Reading Your Text Messages?
https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html
MESSAGETAP: Who's Reading Your Text Messages?
https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-s-reading-your-text-messages.html
This Is Not a Test: APT41 Initiates Global Intrusion Campaign - FireEye
https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/k/apt41-perfects-code-signing-abuse.html
ALPHV/BlackCat and APT41 Connection Analysis - Cisco Talos
https://blog.talosintelligence.com/chinese-hacking-group-apt41/
APT41 Deploys KEYPLUG Backdoor
https://www.trendmicro.com/en_us/research/22/h/apt41-deployskeyplug-backdoor.html
Examining the KEYPLUG Backdoor Used by APT41
https://www.mandiant.com/resources/blog/examining-keyplug-backdoor-apt41
APT41 World Tour 2021 - FireEye
https://www.mandiant.com/resources/reports/apt41-world-tour-2021
Chinese APT Groups Caught Exploiting Barracuda Zero-Day - CISA Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
APT41 World Tour 2021: A Regional Perspective on Tactics, Techniques and Procedures
https://www.mandiant.com/resources/blog/apt41-us-state-governments-2022
APT41 Exploits CVE-2024-23113 to Target Government and Defense
https://www.fortinet.com/blog/psirt-blogs/analysis-of-apt41-operations
Chinese APT Groups Targeting Southeast Asian Government Institutions
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-sea-government-institutions.html
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.sentinelone.com/labs/apt41-perfects-code-signing-abuse/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.sentinelone.com/blog/apt41-perfects-code-signing-abuse-to-escalate-supply-chain-attacks/
Chinese APT41 Hackers Target Android Devices - Mandiant 2024
https://www.mandiant.com/resources/blog/apt41-targets-android-devices
Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation
https://services.google.com/fh/files/misc/apt41_double_dragon_a_dual_espionage_and_cyber_crime_operation.pdf
APT41 Exploits F5 BIG-IP Vulnerability CVE-2023-46747
https://www.mandiant.com/resources/blog/apt41-exploits-f5-big-ip
Double Dragon APT41 - Dragos
https://www.dragos.com/threat/double-dragon/
APT41: Chinese Espionage Group Exploits Zero-Days
https://www.crowdstrike.com/blog/wicked-panda-apt41-deploys-unprecedented-zero-day-exploits/
APT41 - CISA Cybersecurity Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-321a
APT41 Compromises Networks via SQLServer
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-sqlserver
Chinese Espionage Operations Leverage UNC5221 and APT41 - Google Cloud
https://cloud.google.com/blog/topics/threat-intelligence/chinese-espionage-operations
APT41 and Earth Longzhi Campaign Analysis - Trend Micro 2024
https://www.trendmicro.com/en_us/research/24/a/earth-longzhi-apt41.html
Chinese APT Groups Targeting Asia in Campaigns Linked to LEAD
https://www.trendmicro.com/en_us/research/24/b/chinese-apt-groups-targeting-asia.html
APT41 Has Arisen From the DUST - Mandiant
https://www.mandiant.com/resources/apt41-arisen-from-dust
Chinese APT41 Hackers Target Taiwanese Government Agencies
https://www.trendmicro.com/en_us/research/24/b/chinese-apt41-hackers-target-taiwanese-government-agencies.html
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/reports/apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation
Chinese APT41 Perfects Code Signing Abuse - Sophos
https://news.sophos.com/en-us/2021/01/26/chinese-apt-apt41-perfects-code-signing-abuse/
Earth Freybug Using UNAPIMON for Unhooking Critical APIs - Trend Micro 2024
https://www.trendmicro.com/en_us/research/24/k/earth-freybug.html
APT41 Exploits CVE-2024-23113 Fortinet Zero-Day - Google Threat Intelligence 2024
https://cloud.google.com/blog/topics/threat-intelligence/apt41-fortinet-zero-day
Chinese APT Groups Observed Exploiting CVE-2023-46747 - Mandiant
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-f5-big-ip
China-Nexus Espionage Group APT41 Continues to Target Diverse Industries
https://security.googleblog.com/2024/03/china-nexus-espionage-apt41-continues.html
APT41 Exploits Vulnerabilities to Deploy StealthVector and Cobalt Strike
https://www.trendmicro.com/en_us/research/23/k/apt41-exploits-vulnerabilities.html
Chinese APT41 Hackers Target Asian Governments in Operation CuckooBees
https://www.cybereason.com/blog/operation-cuckoobees-a-widespread-apt41-campaign
Chinese APT41 Hackers Target Taiwanese Research Institute for Cyber Espionage
https://thehackernews.com/2024/04/chinese-apt41-hackers-target-taiwanese.html
APT41 Exploits FortiOS Zero-Day - Google Threat Intelligence
https://cloud.google.com/blog/topics/threat-intelligence/apt41-fortios-zero-day-exploitation
APT41 Exploits CVE-2024-23113 to Deploy DUSTPAN Malware
https://www.mandiant.com/resources/blog/apt41-exploits-fortios-flaw
Chinese APT41 Hackers Target Asian Gambling Sector
https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/chinese-apt41-hackers-target-asian-gambling-sector
Chinese APT Groups Targeting Southeast Asian Government Institutions - Trend Micro 2024
https://www.trendmicro.com/en_us/research/24/a/chinese-apt-groups-targeting-sea.html
APT41 Deploys StealthMutant Backdoor - Security Joes 2024
https://www.securityjoes.com/post/apt41-deploys-stealthmutant-backdoor
APT41: Double Dragon - FireEye
https://www.mandiant.com/resources/blog/apt41-double-dragon-dual-espionage-and-cyber-crime-operation
Chinese APT41 Group Leveraged 13 Zero-Days in 2023 Alone - SecurityWeek
https://www.securityweek.com/chinese-apt41-group-leveraged-13-zero-days-in-2023-alone/
APT41: Double Dragon
https://www.mandiant.com/resources/apt41-double-dragon
Chinese APT41 Hackers Target Asian Gambling Sector
https://www.trendmicro.com/en_us/research/23/k/chinese-apt41-hackers-target-asian-gambling-sector.html
Earth Freybug: APT41's Campaigns Across Asia
https://www.trendmicro.com/en_us/research/23/i/earth-freybug.html
APT41 World Tour 2024: Analysis of Recent Operations
https://www.sentinelone.com/labs/apt41-world-tour-2024/
APT41 Exploits CVE-2024-23113 in Ivanti Connect Secure VPN
https://www.mandiant.com/resources/blog/apt41-exploits-ivanti-connect-secure-vpn
Chinese APT41 Hackers Target Global Shipping and Manufacturing Sectors
https://www.trendmicro.com/en_us/research/23/k/earth-baku-apt41-shipping-manufacturing.html
APT41 Has Arisen From the DUST | DUSTPAN and DUSTTRAP Backdoors
https://www.mandiant.com/resources/blog/apt41-arisen-dust-dustpan-dusttrap
Chinese APT Groups Target Barracuda ESG Zero-Day (CVE-2023-2868)
https://www.mandiant.com/resources/blog/chinese-actors-target-barracuda-esg
APT41 Leverages Google Workspace and Drive for C2
https://cloud.google.com/blog/topics/threat-intelligence/apt41-google-workspace-drive-c2
CISA Alert: APT41 Exploits Zero-Day Vulnerabilities in Multiple Products
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b
Double Dragon APT41 and a Multi-Year Campaign
https://www.fortinet.com/blog/threat-research/apt41-campaign
APT41 World Tour 2021 on a Tight Schedule
https://www.trendmicro.com/en_us/research/21/l/apt41-world-tour-2021.html
Chinese APT41 Hackers Target Asian Gambling Industry
https://thehackernews.com/2024/01/chinese-apt41-hackers-target-asian.html
APT41 Campaign Targeting U.S. State Governments
https://www.mandiant.com/resources/apt41-us-state-governments
APT41 Compromises Networks via F5 BIG-IP Vulnerability
https://www.mandiant.com/resources/blog/apt41-compromises-networks-via-f5-bigip
Hunting for APT41 Infiltration and Exploitation
https://www.crowdstrike.com/blog/apt41-infiltration-and-exploitation/
APT41 World Tour 2021: A Global Intrusion Campaign
https://www.mandiant.com/resources/blog/apt41-global-intrusion-campaign
Double Dragon APT41 and Indictment Fallout
https://www.recordedfuture.com/apt41-double-dragon-china-cyber-espionage
APT41 Exploits CVE-2024-23113 in Fortinet Devices
https://www.mandiant.com/resources/blog/apt41-fortinet-exploitation
Earth Longzhi Returns With Improved Tactics
https://www.trendmicro.com/en_us/research/24/e/earth-longzhi-returns-improved-tactics.html
Chinese APT Groups Observed Actively Exploiting CVE-2023-46747
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploiting-f5-big-ip
KEYPLUG Malware Analysis - Google Threat Analysis Group
https://blog.google/threat-analysis-group/tracking-apt41-operations-keyplug-backdoor/
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/e/apt41-perfects-code-signing-abuse.html