Loading story…
Google-owned Mandiant detailed how APT41, a China-linked threat group also known as Double Dragon, continues to blend state-aligned espionage with financially motivated intrusions. The reporting describes a long-running operation in which the group targets organizations across multiple sectors and geographies while using a broad toolkit of malware, compromised infrastructure, and hands-on-keyboard tradecraft to steal data, maintain persistence, and support intelligence collection.
Mandiant said APT41 stands out because it operates at the intersection of nation-state espionage and cybercrime, shifting between strategic targeting and profit-driven activity without separating the two missions. The group has been tied to intrusions affecting enterprises worldwide and remains notable for its adaptability, operational scale, and ability to exploit trusted environments to advance both theft and surveillance objectives.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Intrusion Truth published a case study focused on APT41, adding public reporting and analysis about the threat group. Based on the provided reference, this is an earlier documented publication about APT41 distinct from Mandiant's 2024 report.
Mandiant released a report detailing APT41 as a Chinese threat group conducting both state-aligned espionage and financially motivated cybercrime operations. The two provided references appear to describe the same publication and are treated as a single event.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
mandiant.com
Open sourcemandiant.com
Open sourceintrusiontruth.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FireEye identified **APT40** as a China-nexus espionage group active since at least 2013, targeting engineering, transportation, and defense organizations with a strong focus on maritime technologies and other sectors tied to China’s strategic interests. The group has used web server exploitation, spearphishing, web shells, credential theft, lateral movement, and legitimate platforms such as **GitHub**, **Google**, and **Pastebin** for command-and-control, while expanding targeting to countries relevant to the **Belt and Road Initiative**, including the U.S. and U.K. Separate reporting alleged that APT40 is operated through a Hainan-based network tied to China’s **Ministry of State Security (MSS)**, with front companies and recruitment activity linked to alleged intelligence officer **Ding Xiaoyang**. The broader reporting portrays APT40 as part of a larger Chinese state-directed cyber ecosystem in which responsibility for major offensive operations shifted from the PLA toward the MSS, supporting long-term espionage goals such as intellectual property theft, strategic intelligence collection, and rapid exploitation of newly disclosed vulnerabilities.
Aug 15, 2026
The U.S. Department of Justice charged seven international defendants, including five alleged members of **APT41**, over computer intrusion campaigns that hit more than 100 victims worldwide. Prosecutors said the group targeted universities, software developers, telecommunications providers, social media companies, video game firms, nonprofits, and foreign governments, stealing source code, customer account data, and personally identifiable information while pursuing both **espionage** and **financial gain**. The indictments describe activity ranging from supply-chain compromises and credential theft to fraud involving in-game currency and other monetization schemes. Reporting tied the charged activity to broader APT41 operations, including **ColdLock** ransomware attacks against Taiwanese organizations, especially in the energy sector. In those intrusions, attackers were observed using **Active Directory Group Policy**, scheduled tasks, **SMB**, **PowerShell**, customized loaders, and **Cobalt Strike** to move laterally and deploy ransomware. Trend Micro said related activity also affected energy, retail, and telecommunications organizations in Southeast Asia, with infrastructure overlaps and targeting patterns suggesting links between criminal operations and Chinese state-aligned espionage.
Aug 14, 2026
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026