Names APT 41 (FireEye) Double Dragon (FireEye) TG-2633 (SecureWorks) Bronze Atlas (SecureWorks) Red Kelpie (PWC) Blackfly (Symantec) Earth Baku (Trend Micro) SparklingGoblin (ESET) Grayfly (Symantec) TA415 (Proofpoint) BrazenBamboo (Volexity) Country China China Sponsor State-sponsored Motivation Financial crime, Information theft and espionage First seen 2012 Description (FireEye) FireEye Threat Intelligence assesses with high confidence that APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control. Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely state-sponsored activity. This is remarkable because explicit financially motivated targeting is unusual among Chinese state-sponsored threat groups, and evidence suggests these two motivations were balanced concurrently from 2014 onward. • APT41 overlaps at least partically with public reporting on group including Barium and Winnti Group, Wicked Panda. In some cases the primary observed similarity in the publicly reported Winnti activity was the use of the same malware – including HIGHNOON – across otherwise separate clusters of activity. • Previous FireEye Threat Intelligence reporting on the use of HIGHNOON and related activity was grouped together under both Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon and Mana, although we now understand this to be the work of several Chinese cyber espionage groups that share tools and digital certificates. • APT41 reflects our current understanding of what was previously reported as GREF, as well as additional indicators and activity gathered during our extensive review of our intelligence holdings. APT 41 has 2 subgroups: 1. Subgroup: Earth Longzhi 2. Subgroup: Earth Freybug Also see Earth Lusca and RedGolf. Observed Sectors: Construction, Defense, Education, Energy, Financial, Government, Healthcare, High-Tech, Hospitality, Manufacturing, Media, Oil and gas, Petrochemical, Pharmaceutical, Retail, Shipping and Logistics, Telecommunications, Transportation, Online video game companies. Countries: Australia, Bahrain, Brazil, Canada, Chile, Denmark, Finland, France, Georgia, Hong Kong, India, Indonesia, Italy, Japan, Malaysia, Mexico, Myanmar, Netherlands, Pakistan, Philippines, Poland, Qatar, Saudi Arabia, Singapore, South Korea, South Africa, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, UK, USA, Vietnam. Tools used 9002 RAT, AceHash, ADORE.XSEC, AntSword, ASPXSpy, Barlaiy, BEACON, BIOPASS RAT, BlackCoffee, BLUEBEAM, certutil, China Chopper, Cobalt Strike, COLDJAVA, Crackshot, CrossWalk, DBoxAgent, DEADEYE, DEPLOYLOG, Derusbi, DIRTCLEANER, DragonEgg, DUSTPAN, DUSTTRAP, EasyNight, FunnySwitch, GearShift, Gh0st RAT, HDRoot, HighNoon, HighNote, HKDOOR, HUI Loader, Jumpall, KEYPLUG, LATELUNCH, LIFEBOAT, Lowkey, MessageTap, Meterpreter, Mimikatz, MoonBounce, MoonWalk, njRAT, NTDSDump, PACMAN, PINEGROVE, PipeMon, PlugX, POTROAST, PRIVATELOG, pwdump, RedXOR, ROCKBOOT, SAGEHIRE, SerialVlogger, ShadowHammer, ShadowPad Winnti, SideWalk, Skip-2.0, SPARKLOG, Speculoos, Spyder, SQLULDR2, STASHLOG, SWEETCANDLE, TERA, TIDYELF, Voldemort, WIDETONE, WINNKIT, Winnti, WINTERLOVE, WyrmSpy, xDll, XDOOR, XMRig, ZXShell, Living off the Land. Operations performed Autumn 2016 Breach of TeamViewer Jul 2017 ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organizations worldwide. Jun 2018 Operation “ShadowHammer” A supply-chain attack dubbed “Operation ShadowHammer” has been uncovered, targeting users of the ASUS Live Update Utility with a backdoor injection. The China-backed BARIUM APT is suspected to be at the helm of the project. According to Kaspersky Lab, the campaign ran from June to at least November 2018 and may have impacted more than a million users worldwide – though the adversaries appear to have been after specific victims in Asia. 2019 Operation “CuckooBees” Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation Mar 2019 Although the malware uses different configurations in each case, the three affected software products included the same backdoor code and were launched using the same mechanism. While two of the compromised products no longer include the backdoor, one of the affected developers is still distributing the trojanized version: ironically, the game is named Infestation, and is produced by Thai developer Electronics Extreme. Apr 2019 In April 2019, FireEye’s Managed Defense team identified suspicious activity on a publicly-accessible web server at a U.S.-based research university. This activity, indicated that the attackers were exploiting CVE-2019-3396, a vulnerability in Atlassian Confluence Server that allowed for path traversal and remote code execution. Aug 2019 APT41’s newest espionage tool, MESSAGETAP, was discovered during a 2019 investigation at a telecommunications network provider within a cluster of Linux servers. Specifically, these Linux servers operated as Short Message Service Center (SMSC) servers. Oct 2019 Winnti Group’s skip‑2.0: A Microsoft SQL Server backdoor Nov 2019 In November 2019, we discovered a new campaign run by the Winnti Group against two Hong Kong universities. We found a new variant of the ShadowPad backdoor, the group’s flagship backdoor, deployed using a new launcher and embedding numerous modules. The Winnti malware was also found at these universities a few weeks prior to ShadowPad. Jan 2020 Between January 20 and March 11, FireEye observed APT41 attempt to exploit vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central at over 75 FireEye customers. Feb 2020 In February 2020, we discovered a new, modular backdoor, which we named PipeMon. Persisting as a Print Processor, it was used by the Winnti Group against several video gaming companies that are based in South Korea and Taiwan and develop MMO (Massively Multiplayer Online) games. Video games developed by these companies are available on popular gaming platforms and have thousands of simultaneous players. 2020 New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor Mar 2020 During threat research in March 2020, PT Expert Security Center specialists found a previously unknown backdoor and named it xDll, based on the original name found in the code. As a result of a configuration flaw of the malware's command and control (C2) server, some server directories were externally accessible. Apr 2020 Hackers linked to Chinese government stole millions in Covid benefits, Secret Service says Jul 2020 APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign Oct 2020 Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41 2021 APT41 World Tour 2021 on a tight schedule Feb 2021 You never walk alone: The SideWalk backdoor gets a Linux variant Early 2021 New Wave of Espionage Activity Targets Asian Governments Mar 2021 Operation “ColunmTK” Big airline heist Spring 2021 MoonBounce: the dark side of UEFI firmware May 2021 Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments Jul 2021 BIOPASS RAT: New Malware Sniffs Victims via Live Streaming Aug 2021 The SideWalk may be as dangerous as the CROSSWALK Aug 2022 Winnti APT group docks in Sri Lanka for new campaign Late 2022 Blackfly: Espionage Group Targets Materials Technology Late 2022 A Dive into Earth Baku’s Latest Campaign 2023 APT41 Has Arisen From the DUST Jul 2023 APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike Apr 2024 DodgeBox: A deep dive into the updated arsenal of APT41 | Part 1 MoonWalk: A deep dive into the updated arsenal of APT41 | Part 2 Apr 2024 LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign Jul 2024 BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA Aug 2024 The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers “Voldemort” Counter operations Aug 2020 Seven International Cyber Defendants, Including “Apt41” Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally Information MITRE ATT&CK Last change to this card: 27 December 2024