APT41: a well-documented and highly active threat group. APT41: (a.k.a. Double Dragon, BARIUM, Winnti)
China: It’s believed to be state-sponsored, likely tied to China’s Ministry of State Security (MSS).
APT41 is unique in that it blends state-sponsored espionage with financially motivated cybercrime. It uses both sophisticated custom malware and publicly available tools.
Based on the MITRE ATT&CK Framework:
TTP Category | Techniques Used |
---|---|
Initial Access | Spear-phishing emails, watering hole attacks, supply chain compromises |
Execution PowerShell | command-line interface, DLL side-loading. |
Persistence Registry run keys | scheduled tasks, web shells |
Privilege Escalation Exploiting local vulnerabilities | credential dumping |
Defense Evasion Signed binaries | process injection, obfuscated scripts |
Credential Access Mimikatz | LSASS memory scraping |
Discovery Network scanning | account discovery, system info enumeration |
Lateral Movement | Remote desktop, SMB, Windows Admin Shares |
Exfiltration Encrypted channels | custom C2 over HTTPS/DNS |
Impact Ransomware deployment | deletion of logs |
APT41 has attacked a wide range of sectors across multiple continents.
They are known for:
Tool/Malware Purpose