APT41
APT41 is a China-linked, state-sponsored threat actor that has also been associated with financially motivated activity. The content identifies numerous aliases including Winnti, BARIUM, HOODOO, Aquatic Panda, Wicked Panda, Brass Typhoon, Bronze Atlas, Bronze University, Charcoal Typhoon, Chromium, Double Dragon, Grayfly, Blackfly, Earth Lusca, RedHotel, and Winnti Group/Winnti Umbrella. The content also notes subgroups or related clusters including Blackfly and Grayfly, with Blackfly described as primarily focused on cybercrime and Grayfly on cyberespionage; Earth Freybug is described as a subset of APT41, and Earth Longzhi as a new subgroup of APT41. The content states that Mandiant has tracked APT41 since 2014 and that the group has been active since at least 2012. It describes APT41 as overlapping with other Chinese hacking groups including BARIUM and Winnti, and notes operational, TTP, and toolset overlaps with other China-nexus clusters such as Earth Lusca. The content also characterizes APT41 as part of a broader interconnected Chinese intrusion ecosystem rather than necessarily a single discrete group. Targets mentioned in the content include gaming and non-gaming organizations, a Taiwanese media organization, an Italian job search company, software developers, and victims in the United States, Netherlands, Russia, China, Germany, and Taiwan. Taiwan’s National Security Bureau named APT41 among Chinese groups involved in sustained targeting of Taiwan’s critical infrastructure, including energy, healthcare, communications, government, and technology sectors. Tradecraft and tooling directly mentioned in the content include use of ShadowPad, Winnti malware, GOODLUCK, DEADEYE, KEYPLUG, DUSTTRAP, BrowserGhost, Cobalt Strike, China Chopper, rootkits, bootkits, ransomware, JScript web shells, and the GC2 (Google Command and Control) red teaming framework. The content also associates APT41 with supply-chain attacks involving CCleaner, ShadowPad, and ShadowHammer, and states that the group uses supply-chain and watering-hole attacks. In one 2022 campaign, Google reported APT41 abused GC2 in attacks against a Taiwanese media organization and an Italian job search company, using Google Drive-hosted password-protected files to deliver the GC2 agent and using Google Sheets/Drive for tasking, payload delivery, and exfiltration. Techniques explicitly described in the content include command execution via cmd.exe and WMI/WMIEXEC; persistence via batch files, Startup file modification, an HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost key, and PowerSploit; PowerShell execution; deployment of JScript web shells; file masquerading as antivirus software; use of stolen or leveraged code-signing certificates; collection of machine information, personally identifiable information, account information, employee lists, plaintext and hashed passwords, browser credentials, and local Windows security event logs; querying registry values to identify RDP ports and network configurations; collecting MAC addresses; remote system discovery using MiPing; and deletion of files and artifacts for cleanup. The content also states APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, Windows Credential Editor, YSoSerial.NET, ConfuserEx, and BadPotato. The content further links APT41 to ShadowPad-centric infrastructure and xDll activity attributed to the Winnti group, describing Winnti/APT41/BARIUM/AXIOM as a China-linked state-sponsored group whose interests include espionage and financial gain.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
65 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
51 malware families attributed to this actor across reporting.
46 additional families tracked in Mallory.
Associated vulnerabilities
45 CVEs this actor has used in observed campaigns. 45 of them exploited in the wild.
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.
During C0017, APT41 exploited ... CVE-2021-44228 in Log4j... During C0018, the threat actors exploited ... several Log4Shell vulnerabilities, including CVE-2021-44228... Magic Hound has exploited the Log4j utility (CVE-2021-44228).
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...
40 more CVEs tied to this actor tracked in Mallory.
Observables
340 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced in a related-content headline as delivering a backdoor to harvest cloud credentials.
Historically associated with techniques similar to the observed abuse of CDN infrastructure via the 'Underminr' method for malware delivery, phishing, and resilient command-and-control evasion, but not directly attributed in this report.
Chinese nexus threat actor conducting both financially motivated intrusions and espionage campaigns, including use and development of ShadowPad, against a wide range of global targets.
Referenced as a China-aligned intrusion set historically associated with ShadowPad malware.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.