state-sponsored-espionagecredential-stealer-activitycloud-service-vulnerabilitycommand-and-control-method

APT41 Deploys Linux Winnti Backdoor to Steal Multi-Cloud Credentials

Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Apr 13, 2026

APT41, a China-linked threat group, has deployed a new Linux ELF backdoor from the Winnti malware family to compromise cloud workloads and steal credentials from AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud environments. Researchers said the implant was built for stealth rather than disruption, harvesting metadata, temporary tokens, and local credential files while evading common detection methods; at the time of analysis, it reportedly had zero detections on VirusTotal. The malware abuses cloud metadata services, including the AWS instance metadata endpoint 169.254.169.254, creating a path to broader cloud access when attached permissions are overly permissive.

The campaign uses unusual tradecraft to blend into normal operations, including SMTP-based command and control over port 25, a selective handshake mechanism that limits exposure during scanning, and UDP broadcast beacons on port 6006 that may support lateral movement. Investigators also linked the activity to typosquatted domains themed around Alibaba Cloud and Qianxin, with infrastructure reportedly registered through NameSilo and hosted in part on Alibaba Cloud in Singapore. Defenders were urged to monitor outbound SMTP from non-mail systems, watch for abnormal UDP broadcasts, audit metadata API access, enforce protections such as AWS IMDSv2, and strengthen cloud logging through services such as CloudTrail and Google Cloud Audit Logs.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 20, 2026 – Apr 13, 2026

Apr 13, 20267mo ago
Breakglass Intelligence discloses technical details of the campaign
Breakglass Intelligence publicly reported that the backdoor had zero detections on VirusTotal at the time of analysis and described its stealth features, cloud credential theft behavior, and attribution links to earlier Winnti-related Linux implants. The firm also recommended detections such as monitoring outbound SMTP from non-mail workloads, auditing metadata API access, and enabling stronger cloud logging and identity controls.
Apr 13, 20267mo ago
APT41 deploys Linux Winnti backdoor to steal cloud credentials
APT41 used a Linux ELF/Winnti-family backdoor against cloud workloads to harvest metadata and temporary credentials from AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud environments. The malware used SMTP port 25 as a covert command-and-control channel and supported lateral movement via UDP broadcast traffic on port 6006.
Apr 3, 20267mo ago
Breakglass publishes IOCs and detection rules for APT41 cloud campaign
Breakglass Intelligence released infrastructure indicators and hunting content for the APT41/Winnti Linux backdoor campaign, including YARA and Suricata detections tied to typosquatted domains and Alibaba Cloud-hosted command-and-control infrastructure. The report also documented the malware's cloud credential harvesting and covert SMTP-based C2 behavior.
Zero Detections, Three Typosquat Domains, and a Cloud Credential Harvester: Inside an APT41 Winnti ELF Backdoor - Breakglass Intelligence - Breakglass Intelligence
Jan 20, 20269mo ago
APT41 registers typosquatted cloud-themed infrastructure
Infrastructure linked to the campaign was registered through NameSilo over a 24-hour period on January 20-21, 2026, using WHOIS privacy. The domains mimicked Alibaba Cloud services and the Chinese cybersecurity brand Qianxin, consistent with prior APT41 tradecraft.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

APT41

Malware

1 linked

Winnti

Affected products

1 linked

Amazon Web Services

Organizations

4 linked

Alibaba GroupAmazon Web ServicesMicrosoft CorporationGoogle

Observables

6 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Apr 14, 2026

APT41 Turns Linux Cloud Servers Into Credential Theft Targets With New Winnti Backdoor - Cyber Security NewsOpen source ↗

Dark ReadingNews · Apr 13, 2026

APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud CredentialsOpen source ↗

Breakglass IntelNews · Apr 10, 2026

APT41 Winnti ELF Cloud Credential Harvester: Alibaba Typosquat Infrastructure & 6-Year Lineage - Breakglass IntelligenceOpen source ↗

Breakglass IntelNews · Apr 3, 2026

Zero Detections, Three Typosquat Domains, and a Cloud Credential Harvester: Inside an APT41 Winnti ELF Backdoor - Breakglass Intelligence - Breakglass IntelligenceOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

state-sponsored-espionagecredential-stealer-activitycloud-service-vulnerabilitycommand-and-control-method

APT41 Deploys Linux Winnti Backdoor to Steal Multi-Cloud Credentials

Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Apr 13, 2026

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 20, 2026 – Apr 13, 2026

Apr 13, 20267mo ago
Breakglass Intelligence discloses technical details of the campaign
Breakglass Intelligence publicly reported that the backdoor had zero detections on VirusTotal at the time of analysis and described its stealth features, cloud credential theft behavior, and attribution links to earlier Winnti-related Linux implants. The firm also recommended detections such as monitoring outbound SMTP from non-mail workloads, auditing metadata API access, and enabling stronger cloud logging and identity controls.
Apr 13, 20267mo ago
APT41 deploys Linux Winnti backdoor to steal cloud credentials
APT41 used a Linux ELF/Winnti-family backdoor against cloud workloads to harvest metadata and temporary credentials from AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud environments. The malware used SMTP port 25 as a covert command-and-control channel and supported lateral movement via UDP broadcast traffic on port 6006.
Apr 3, 20267mo ago
Breakglass publishes IOCs and detection rules for APT41 cloud campaign
Breakglass Intelligence released infrastructure indicators and hunting content for the APT41/Winnti Linux backdoor campaign, including YARA and Suricata detections tied to typosquatted domains and Alibaba Cloud-hosted command-and-control infrastructure. The report also documented the malware's cloud credential harvesting and covert SMTP-based C2 behavior.
Zero Detections, Three Typosquat Domains, and a Cloud Credential Harvester: Inside an APT41 Winnti ELF Backdoor - Breakglass Intelligence - Breakglass Intelligence
Jan 20, 20269mo ago
APT41 registers typosquatted cloud-themed infrastructure
Infrastructure linked to the campaign was registered through NameSilo over a 24-hour period on January 20-21, 2026, using WHOIS privacy. The domains mimicked Alibaba Cloud services and the Chinese cybersecurity brand Qianxin, consistent with prior APT41 tradecraft.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →