APT41
Wicked PandaBrass TyphoonBARIUM
ChinaPRC state-sponsored; US DOJ indicted members in 2020 (Chengdu 404 contractors)
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.
MITRE ATT&CK Techniques
T1003.001T1003.002T1003.003T1005T1008T1012T1014T1016T1018T1021.001T1021.002T1027T1027.002T1030T1033T1036.004T1036.005T1037T1046T1047T1049T1053.005T1055T1056.001T1059.001T1059.003T1059.004T1069T1070.003T1070.004T1071.001T1071.002T1071.004T1078T1082T1083T1087.001T1087.002T1090T1098.007T1102.001T1104T1105T1110T1112T1133T1135T1136.001T1190T1195.002T1197T1203T1213.003T1218.001T1218.011T1480.001T1484.001T1486T1496.001T1542.003T1543.003T1546.008T1547.001T1550.002T1553.002T1555T1555.003T1560.001T1566.001T1568.002T1569.002T1570T1574.001T1574.006T1588.002T1595.002T1595.003T1596.005T1599T1684.001T1685T1685.005
Associated Malware
ASPXSpyBITSAdminBLACKCOFFEEChina ChopperCobalt StrikeDUSTPANDUSTTRAPDerusbiEmpireImpacketKEYPLUGLightSpyMESSAGETAPMOPSLEDMimikatzNetPingPlugXPowerSploitROCKBOOTShadowPadWinnti for LinuxZxShellcertutildsqueryftpgh0st RATipconfignetstatnjRATpwdumpsqlmap
- HighAPTVulnerabilityBlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing RevocationsThe Hacker News · 2d ago