ETDA ThaiCERT
Report
Search
Home > List all groups > APT 41

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: APT 41

NamesAPT 41 (FireEye)
CountryChina China
SponsorState-sponsored
MotivationFinancial crime, Information theft and espionage
First seen2012
Description(FireEye) FireEye Threat Intelligence assesses with high confidence that APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control. Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely state-sponsored activity. This is remarkable because explicit financially motivated targeting is unusual among Chinese state-sponsored threat groups, and evidence suggests these two motivations were balanced concurrently from 2014 onward.

• APT41 overlaps at least partically with public reporting on group including Barium and Winnti Group, Blackfly, Wicked Panda. In some cases the primary observed similarity in the publicly reported Winnti activity was the use of the same malware – including HIGHNOON – across otherwise separate clusters of activity.
• Previous FireEye Threat Intelligence reporting on the use of HIGHNOON and related activity was grouped together under both Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon and Mana, although we now understand this to be the work of several Chinese cyber espionage groups that share tools and digital certificates.
• APT41 reflects our current understanding of what was previously reported as GREF, as well as additional indicators and activity gathered during our extensive review of our intelligence holdings.
ObservedSectors: Construction, Defense, Education, Energy, Financial, Government, Healthcare, High-Tech, Hospitality, Manufacturing, Media, Oil and gas, Petrochemical, Pharmaceutical, Retail, Telecommunications, Transportation, Online video game companies.
Countries: Australia, Brazil, Canada, Chile, Denmark, Finland, France, Hong Kong, India, Indonesia, Italy, Japan, Malaysia, Mexico, Myanmar, Netherlands, Pakistan, Philippines, Poland, Qatar, Saudi Arabia, Singapore, South Korea, South Africa, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, UK, USA, Vietnam.
Tools used9002 RAT, AceHash, ADORE.XSEC, ASPXSpy, Barlaiy, BlackCoffee, certutil, China Chopper, Cobalt Strike, COLDJAVA, Crackshot, CrossWalk, DEADEYE, Derusbi, DIRTCLEANER, EasyNight, GearShift, Gh0st RAT, HDRoot, HighNoon, HighNote, HKDOOR, Jumpall, LATELUNCH, LIFEBOAT, Lowkey, MessageTap, Meterpreter, Mimikatz, njRAT, NTDSDump, PACMAN, PipeMon, PlugX, POTROAST, pwdump, ROCKBOOT, SAGEHIRE, ShadowHammer, ShadowPad Winnti, Skip-2.0, Speculoos, SWEETCANDLE, TERA, TIDYELF, WIDETONE, Winnti, WINTERLOVE, xDll, XDOOR, XMRig, ZXShell, Living off the Land.
Operations performedAutumn 2016Breach of TeamViewer
<https://www.bleepingcomputer.com/news/security/teamviewer-confirms-undisclosed-breach-from-2016/>
Jul 2017ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organizations worldwide.
<https://www.kaspersky.com/about/press-releases/2017_shadowpad-how-attackers-hide-backdoor-in-software-used-by-hundreds-of-large-companies-around-the-world>
Jun 2018Operation “ShadowHammer”
A supply-chain attack dubbed “Operation ShadowHammer” has been uncovered, targeting users of the ASUS Live Update Utility with a backdoor injection. The China-backed BARIUM APT is suspected to be at the helm of the project.
According to Kaspersky Lab, the campaign ran from June to at least November 2018 and may have impacted more than a million users worldwide – though the adversaries appear to have been after specific victims in Asia.
<https://threatpost.com/asus-pc-backdoors-shadowhammer/143129/>
Mar 2019Although the malware uses different configurations in each case, the three affected software products included the same backdoor code and were launched using the same mechanism. While two of the compromised products no longer include the backdoor, one of the affected developers is still distributing the trojanized version: ironically, the game is named Infestation, and is produced by Thai developer Electronics Extreme.
<https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/>
Apr 2019In April 2019, FireEye’s Managed Defense team identified suspicious activity on a publicly-accessible web server at a U.S.-based research university. This activity, indicated that the attackers were exploiting CVE-2019-3396, a vulnerability in Atlassian Confluence Server that allowed for path traversal and remote code execution.
<https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html>
Aug 2019APT41’s newest espionage tool, MESSAGETAP, was discovered during a 2019 investigation at a telecommunications network provider within a cluster of Linux servers. Specifically, these Linux servers operated as Short Message Service Center (SMSC) servers.
<https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html>
Oct 2019Winnti Group’s skip‑2.0: A Microsoft SQL Server backdoor
<https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/>
Nov 2019In November 2019, we discovered a new campaign run by the Winnti Group against two Hong Kong universities. We found a new variant of the ShadowPad backdoor, the group’s flagship backdoor, deployed using a new launcher and embedding numerous modules. The Winnti malware was also found at these universities a few weeks prior to ShadowPad.
<https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/>
Jan 2020Between January 20 and March 11, FireEye observed APT41 attempt to exploit vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central at over 75 FireEye customers.
<https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html>
<https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/>
Feb 2020In February 2020, we discovered a new, modular backdoor, which we named PipeMon. Persisting as a Print Processor, it was used by the Winnti Group against several video gaming companies that are based in South Korea and Taiwan and develop MMO (Massively Multiplayer Online) games. Video games developed by these companies are available on popular gaming platforms and have thousands of simultaneous players.
<https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/>
Mar 2020During threat research in March 20201, PT Expert Security Center specialists found a previously unknown backdoor and named it xDll, based on the original name found in the code. As a result of a configuration flaw of the malware's command and control (C2) server, some server directories were externally accessible.
<https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/shadowpad-new-activity-from-the-winnti-group/>
Counter operationsAug 2020Seven International Cyber Defendants, Including “Apt41” Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally
<https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer>
Information<http://content.fireeye.com/apt41/rpt-apt41>
<https://arstechnica.com/information-technology/2018/05/researchers-link-a-decade-of-potent-hacks-to-chinese-intelligence-group/>
<https://www.kaspersky.com/about/press-releases/2019_operation-shadowhammer-new-supply-chain-attack>
<https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf>
MITRE ATT&CK<https://attack.mitre.org/groups/G0096/>

Last change to this card: 19 October 2020

Download this actor card in PDF or JSON format

Previous: APT 33, Elfin, Magnallium
Next: AVIVORE

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key