Loading story…
APT41, a China-linked threat group, has deployed a new Linux ELF backdoor from the Winnti malware family to compromise cloud workloads and steal credentials from AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud environments. Researchers said the implant was built for stealth rather than disruption, harvesting metadata, temporary tokens, and local credential files while evading common detection methods; at the time of analysis, it reportedly had zero detections on VirusTotal. The malware abuses cloud metadata services, including the AWS instance metadata endpoint 169.254.169.254, creating a path to broader cloud access when attached permissions are overly permissive.
The campaign uses unusual tradecraft to blend into normal operations, including SMTP-based command and control over port 25, a selective handshake mechanism that limits exposure during scanning, and UDP broadcast beacons on port 6006 that may support lateral movement. Investigators also linked the activity to typosquatted domains themed around Alibaba Cloud and Qianxin, with infrastructure reportedly registered through NameSilo and hosted in part on Alibaba Cloud in Singapore. Defenders were urged to monitor outbound SMTP from non-mail systems, watch for abnormal UDP broadcasts, audit metadata API access, enforce protections such as AWS IMDSv2, and strengthen cloud logging through services such as CloudTrail and Google Cloud Audit Logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence publicly reported that the backdoor had zero detections on VirusTotal at the time of analysis and described its stealth features, cloud credential theft behavior, and attribution links to earlier Winnti-related Linux implants. The firm also recommended detections such as monitoring outbound SMTP from non-mail workloads, auditing metadata API access, and enabling stronger cloud logging and identity controls.
APT41 used a Linux ELF/Winnti-family backdoor against cloud workloads to harvest metadata and temporary credentials from AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud environments. The malware used SMTP port 25 as a covert command-and-control channel and supported lateral movement via UDP broadcast traffic on port 6006.
Breakglass Intelligence released infrastructure indicators and hunting content for the APT41/Winnti Linux backdoor campaign, including YARA and Suricata detections tied to typosquatted domains and Alibaba Cloud-hosted command-and-control infrastructure. The report also documented the malware's cloud credential harvesting and covert SMTP-based C2 behavior.
Infrastructure linked to the campaign was registered through NameSilo over a 24-hour period on January 20-21, 2026, using WHOIS privacy. The domains mimicked Alibaba Cloud services and the Chinese cybersecurity brand Qianxin, consistent with prior APT41 tradecraft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkreading.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a cloud-focused credential theft campaign broadened beyond **AWS** to also target **Microsoft Azure** and **Google Cloud Platform**, using exposed Docker services as an initial access point. The activity, observed in June 2023 and detailed by SentinelLABS and Permiso, relied on modular shell scripts and a **UPX-packed Golang ELF** payload to collect cloud credentials, profile compromised hosts, inspect containers, and harvest environment variables from running processes. The tooling also showed worm-like behavior by scanning for exposed Docker daemons on ports `2375` and `2376` with utilities including `masscan` and `zgrab`, then exfiltrating stolen data to **AnonDNS-hosted infrastructure** protected by hardcoded HTTP credentials. Researchers said the tradecraft overlaps with tooling previously linked to **TeamTNT**, but stopped short of firm attribution because the scripts are easily reused or modified; they assessed the actor is actively refining the malware for broader cloud-focused operations against Azure and GCP environments.
Jun 29, 2026
Threat actors targeted **Huawei Cloud Elastic Cloud Service (ECS)** instances with an upgraded Linux malware set designed for cryptojacking and broader cloud compromise. The operation deliberately interfered with Huawei Cloud defenses by disabling security-related services such as **hostguard** and abusing the `cloudResetPwdUpdateAgent` plugin, indicating environment-specific tradecraft rather than generic Linux opportunism. The attackers also sanitized infected systems by removing competing malware, deleting rival users and SSH keys, creating stealthy privileged accounts, installing **Tor**, and establishing persistence. The campaign deployed two main payloads: an obfuscated ELF backdoor, `linux64_shell`, which used a **CrossC2/Cobalt Strike-compatible** library to communicate with command-and-control infrastructure, and a Go-based scanner, `xlinux`, built on the **kunpeng** framework to spread further. The scanner searched for weak credentials and exploitable services, including **Oracle WebLogic** systems vulnerable to `CVE-2020-14882`, underscoring how cloud misconfigurations and poor credential hygiene continued to provide a path for cryptojacking-focused intrusions.
Aug 14, 2026
Unknown threat actors conducted a targeted npm supply-chain campaign against developers using Alibaba Group internal tooling, publishing seemingly benign packages and lure packages that impersonated private `@ali`-scoped modules. The packages chained together loader components that fetched malicious configuration and later-stage payloads from attacker-controlled GitHub repositories and Alibaba Cloud infrastructure, then used a Node.js `vm` sandbox escape to reach the host process and install a cross-platform remote access trojan called **aone-cli**. The malware provided command execution, file transfer, persistence, reverse proxying, and DingTalk-enabled lateral movement, indicating an operation designed for long-term access rather than opportunistic abuse. The intrusion established persistence differently across macOS, Windows, and Linux, including modifying `~/.zshrc`, replacing the Alilang security application's `app.asar`, and launching a detached binary from `/tmp` on Linux. Reporting and associated indicators tie the activity to artifacts including **aone-cli**, **aone-kit**, `app.asar`, `crypto.js`, and `setting.js`, along with downloads hosted on Alibaba Cloud OSS and Function Compute services. The malware also tampered with AI-related tooling by patching Python scripts in `.skills` directories used by enterprise collaboration products such as DingTalk, Wukong, and Qoder, while the targeting and tradecraft point to a likely industrial espionage objective.
Aug 4, 2026