🇺🇸 United States🇬🇧 United Kingdom🇮🇳 India🇰🇷 South Korea🌍 Global
Overview
APT41 is a unique dual-mission Chinese threat group that conducts both state-sponsored espionage and financially motivated cybercrime. Attributed to contractors working with China's MSS, the group has targeted healthcare, telecoms, technology, and video game companies. Several members were indicted by the US DOJ in 2020. Known for supply chain attacks, exploitation of zero-day vulnerabilities, and large-scale data theft operations.
Deployment of Linux variant of KeyPlug backdoor against telecommunications providers.
2021
USAHerds/Log4j Campaign
Exploitation of Log4j and USAHerds application targeting US state governments.
2020
Citrix/Cisco/Zoho Exploitation
Mass exploitation of vulnerabilities in enterprise networking products.
2019
Operation CuckooBees
Multi-year espionage campaign targeting technology and manufacturing companies.
Detection Engineering
Web Shell Detection on IIS/Apache
Monitor web server directories for new or modified script files (.aspx, .jsp, .php). Detect w3wp.exe or httpd spawning cmd.exe, powershell.exe, or bash. File integrity monitoring on web root directories. Sigma rule: web_webshell_detection.
Detect unsigned DLLs loaded by legitimate signed executables using Sysmon Event ID 7. Monitor known side-loading host binaries: vmnat.exe, colorcpl.exe, consent.exe. Alert on DLL loads from non-standard directories by trusted processes.
Alert on DNS queries with subdomain labels exceeding 50 characters or high entropy values. Monitor for excessive DNS TXT record queries to single domains. Deploy passive DNS monitoring to identify newly registered domains mimicking legitimate services.
Rare dual-purpose actor conducting both state espionage and financially motivated cybercrime. Extremely versatile with supply chain and zero-day capability.
Legal Actions & Sanctions
2020-09
DOJ charges 7 for APT41 hacking campaign spanning 100+ victims
