Also known as: Double Dragon, BARIUM, Brass Typhoon, Wicked Panda, Winnti, LEAD, Red Kelpie, Earth Baku, Wicked Spider, Bronze Atlas, HOODOO, RedGolf, MISSION2025, UNC5221, Blackfly, Grayfly, Earth Freybug, Earth Longzhi, SparklingGoblin, UNIT2025, Leopard Typhoon
T1195.002
T1574.001
T1574.002
T1071.001
T1588.002
T1583.001
T1053.005
T1055.001
T1055.012
T1057
T1070.004
T1112
T1135
T1204.002
T1518.001
T1543.003
T1546.003
T1550.002
T1560.001
T1562.001
T1569.002
T1078.003
T1091
T1199
T1210
T1505.003
T1136.001
T1218.011
T1071.004
T1594
T1595.002
T1059.004
T1132.001
T1132.002
T1537
T1102.002
T1498
T1584.004
T1207
T1556.004
T1552.001
T1606.002
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Process Injection
Inject code into running processes to evade defenses and elevate privileges.
Obfuscated Files or Information
Encrypt, encode, or obfuscate payloads and data to evade detection.
Deobfuscate/Decode Files or Information
Decode or deobfuscate data and files that were previously hidden or encrypted.
Masquerading
Disguise malicious artifacts by manipulating names or locations to appear legitimate.
Ingress Tool Transfer
Download additional tools or payloads from an external system.
Protocol Tunneling
Tunnel network traffic through an existing protocol to avoid detection.
Proxy
Route C2 traffic through intermediary proxies to obscure the source.
Remote Access Software
Use legitimate remote access tools like TeamViewer or AnyDesk for C2.
Modular backdoor platform that was initially deployed via supply chain attack on NetSarang software. Features plugin-based architecture with encrypted C2 using custom DNS tunneling.
Signature rootkit-enabled backdoor shared across multiple Chinese APT groups. Provides persistent access with kernel-level capabilities for hiding processes and network connections.
Modular backdoor loaded via DLL side-loading. Supports keylogging, screen capture, file management, and loading additional plugins from C2 servers.
Versatile RAT shared across Chinese APT groups. Uses DLL side-loading for execution and supports HTTP/DNS/TCP C2 with encrypted communications.
Cross-platform (Windows/Linux) backdoor using WebSocket and custom TCP protocols for C2. Used in attacks against telecommunications and government sectors.
Downloader/launcher that deploys secondary payloads. Uses living-off-the-land binaries and DLL side-loading to maintain stealth during initial compromise.
In-memory dropper that loads encrypted payloads directly into process memory. Used in conjunction with DUSTTRAP for multi-stage deployment.
Passive backdoor for Linux servers that listens on existing network sockets. Extremely difficult to detect as it doesn't create new network connections.
Extensively used for post-exploitation in both espionage and financially motivated operations. Custom loaders deployed via supply chain or spear-phishing vectors.
Lightweight web shell (4KB) providing remote command execution on compromised web servers. Used for initial foothold maintenance and file management.
Used for credential extraction and Kerberos ticket manipulation during lateral movement phases in both espionage and cybercrime operations.
Python framework used for SMB relay attacks, remote execution via wmiexec/smbexec, and credential extraction via secretsdump.
Used for reconnaissance, downloading secondary payloads, disabling security controls, and executing in-memory malware to avoid disk-based detection.
Windows utility abused for downloading payloads from C2 servers and decoding Base64-encoded malware during multi-stage infection chains.
Compromised CCleaner v5.33 build environment in 2017 to distribute ShadowPad backdoor to 2.27 million users. One of the largest software supply chain attacks.
FreeBSD backdoor discovered targeting Citrix ADC/Gateway appliances. Demonstrates APT41's capability to target non-Windows network infrastructure.
Backdoor delivering Cobalt Strike BEACON payloads
Modular backdoor with support for proxy and file operations
Backdoor with kernel driver component for persistence
SMS interception tool targeting telecom infrastructure
Backdoor deployed through compromised software supply chains
UEFI firmware bootkit for stealth and persistence
Lightweight backdoor for remote access and reconnaissance
Cobalt Strike payload used for post-exploitation
Loader and backdoor used to deploy additional malware
Advanced backdoor variant evolved from StealthVector
Backdoor used in targeted espionage campaigns
Backdoor used for reconnaissance and lateral movement
Linux malware variant targeting ESXi hypervisors
Exploit framework targeting edge devices and network appliances
Web shell and backdoor used for persistence on compromised web servers
Loader component used to decrypt and execute additional payloads
Linux-based backdoor for compromised systems
Open-source tunneling tool abused for command and control communications
Linux backdoor targeting cloud environments
Credential harvesting tool targeting authentication credentials
| Type | Value |
|---|---|
| domain | ns1[.]clofrfrede[.]com |
| domain | infestexe[.]com |
| ip | 103[.]230[.]15[.]130 |
| ip | 149[.]28[.]78[.]89 |
| hash | 7966c2c546b71e800cddd2a6d3a8b0e1 |
| hash | 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360 |
| hash | 65da1a9026cf171a5a7779bc5ee45fb1 |
| hash | 39a46d7f1ef9b9a5e40860cd5f646b9d |
| url | hxxps[[://]]www[.]googleapis[.]com/calendar/v3/calendars/ff57964096cadc1a8733cf566b41c9528c89d30edec86326c723932c1e79ebf0@group[.]calendar[.]google[.]com/events |
| ip | 43[.]99[.]48[.]196 |
| ip | 146[.]70[.]87[.]67 |
| domain | ai[.]qianxing[.]co |
| domain | ns1[.]a1iyun[.]top |
| domain | ai[.]aliyuncs[.]help |
| url | tkshopqd[.]s3[.]amazonaws[.]com |
| domain | cdn[.]dellcdn[.]com |
| domain | update[.]centos-packages[.]com |
| ip | 103[.]27[.]109[.]217 |
| ip | 45[.]142[.]212[.]61 |
| hash | a4e9b7f76c2c7f1e8b3d4c5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c |
| domain | checkin[.]travelsanignacio[.]com |
| domain | cdn[.]oracleapi[.]org |
| ip | 45[.]77[.]253[.]135 |
| hash | 5d8c4b2d8f8f0e4f5c6e8a7c9d1f2e4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e |
| domain | webserver[.]selfip[.]biz |
| Domain / Host | Status |
|---|---|
ns1[.]clofrfrede[.]comShadowPad C2 infrastructure | offline |
infestexe[.]comCROSSWALK/DEADEYE C2 domain | offline |
103[.]230[.]15[.]130KeyPlug Linux backdoor C2 server | active |
149[.]28[.]78[.]89Infrastructure used in telecom targeting | offline |
thetavaluemetrics[.]com | active |
www[.]googleapis[.]com | ip_changed |
ai[.]qianxing[.]co | unknown |
ns1[.]a1iyun[.]top | unknown |
ai[.]aliyuncs[.]help | unknown |
tkshopqd[.]s3[.]amazonaws[.]com | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - APT41
https://attack.mitre.org/groups/G0096/
Mandiant - APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
U.S. DOJ - Seven International Cyber Defendants Charged
https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged
KEYPLUG Backdoor: APT41's Pivotal Tool for Cyber Espionage
https://www.group-ib.com/blog/apt41-keyplug/
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/blog/apt41-dual-espionage-and-cyber-crime-operation
Chinese APT41 Hackers Target Android Devices with WyrmSpy, DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-android.html
MoonBounce: the dark side of UEFI firmware
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
Double Dragon APT41, a dual espionage and cyber crime operation
https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
CISA Alert: APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ServiceDesk Plus
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-259a
Mandiant: APT41 Has Arisen From the DUST
https://www.mandiant.com/resources/blog/apt41-arisen-from-dust
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.mandiant.com/resources/blog/apt41-code-signing-certificates
Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html
KEYPLUG Backdoor Used by APT41 in Recent Campaigns
https://www.mandiant.com/resources/blog/APT41-keyplug-backdoor
APT41 World Tour 2021 on a Budget
https://www.mandiant.com/resources/blog/apt41-world-tour-2021
Operation CuckooBees: Deep-Dive into Stealthy Cyberus Campaign
https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-cyberus-campaign
Mark Your Calendar: APT41 Innovative Tactics - Google Cloud
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
APT41 Cyber-Espionage Campaign Targets U.S. Policy Institutions - HivePro
https://hivepro.com/threat-advisory/apt41-cyber-espionage-campaign-targets-u-s-policy-institutions/
China-Linked APT41 Hackers Target U.S. Trade Officials - The Hacker News
https://thehackernews.com/2025/09/china-linked-apt41-hackers-target-us.html
APT PROFILE – MISSION2025 - CYFIRMA
https://www.cyfirma.com/research/apt-profile-mission2025/
APT41 Targets Linux Cloud Servers With New Winnti Backdoor - GBHackers
https://gbhackers.com/new-winnti-backdoor/
Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited - Freemindtronic
https://freemindtronic.com/chrome-v8-zero-day-cve-2025-6554-active-exploit/
China-Nexus Threat Actor Exploiting Ivanti EPMM - EclecticIQ
https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability
APT41: A Dual Espionage and Cyber Crime Operation
https://www.mandiant.com/resources/reports/apt41-double-dragon-dual-espionage-and-cyber-crime-operation
APT41 Exploits Barracuda ESG Zero-Day Vulnerability
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
CISA Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
Fortinet Zero-Day Exploited by APT41
https://www.fortinet.com/blog/psirt-blogs/analysis-of-fg-ir-23-365
APT41 World Tour 2021: Earth Baku Returns
https://www.trendmicro.com/en_us/research/22/f/apt41-earth-baku-returns.html
Chinese APT Groups Targeting Ivanti Connect Secure Devices
https://www.mandiant.com/resources/blog/chinese-apt-groups-exploit-ivanti-connect-secure
APT41 Perfects Code Signing Abuse - Mandiant
https://www.mandiant.com/resources/blog/apt41-perfects-code-signing-abuse
ESET APT Activity Report Q3 2023-Q2 2024
https://www.welivesecurity.com/en/eset-research/apt-activity-report-q3-2023-q2-2024/
This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks
https://www.trendmicro.com/en_us/research/23/i/apt41-perfects-code-signing-abuse.html
APT41 Uses Earth Freybug Malware to Target Governments
https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html