APT41Threat actor
- amoeba
- barium
- brass typhoon
- BRONZE ATLAS
- bronze export
- double dragon
- earth baku
- g0044
- g0096
- grayfly
- hoodoo
- leopard typhoon
- red kelpie
- spire castle
- ta415
- tg-2633
- wicked panda
- wicked spider
- Winnti
APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.From MISP Galaxy
Last reported yesterday, by The Hacker News17 reports
ATT&CK techniques
6 of 96 · each with the sentence it comes from- T1053.005Scheduled Task
“A scheduled task named Secure-Boot-Update is created.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1542.003Bootkit
“BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing – T1027.002”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing – T1027.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations“…an, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report published this week.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia“How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia”
-
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors“In July 2024, the APT41 threat actor leveraged a different executable signed by Sandboxie ("taskhost.exe") to sideload a malicious version of "sbiedll.dll" to deploy a backdoor called MoonWalk ultimately.”
-
BRONZE SANDCASTLE deploys modified Meterpreter shells“…TLE targeting organizations in Asia and Africa, which is typical of several China-based threat groups, including BRONZE PRESIDENT and BRONZE ATLAS.”
-
Tracking Advanced Persistent Threat Groups“These are not lone hackers; they are highly structured syndicates and state-sponsored units—such as the Lazarus Group or APT41—backed by massive financial and geopolitical resources.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“This was especially observed for APTs attributed to China, such as APT41.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“The main malware family used by SHADOW-EARTH-053 was ShadowPad, an advanced modular malware that has been used by APT41 since 2017, before being shared among multiple China-aligned intrusion sets starting in 2019.”
-
Project Swarm: Join the Collective. Defend the Edge“APT41 has exploited zero-days in Fortinet VPNs, Cisco routers, and Citrix appliances.”
-
China-nexus Threat Actor Targets Arabian Gulf Region With PlugX“PlugX is associated with multiple Chinese APT groups, including Mustang Panda, PKPLUG, and APT41.”
-
Ace in the Hole: exposing GambleForce, an SQL injection gang“A notable example of this tactic was observed by Group-IB’s Threat Intelligence unit in an incident involving APT41.”
-
Update to the REF2924 intrusion set and related campaigns“…family that SecureWorks CTU has associated with the BRONZE UNIVERSITY threat group and Positive Technologies ETC has associated with the Winnti group.”
-
Dark Pink“…oup-IB continuously explores and analyzes the methods, tools, and tactics used by some of the world’s most prominent APT groups, such as APT41, but how can large-scale companies and organizations protect themselves when a new APT group emerges, or, if an already existing APT grou…”
-
APT41 World Tour 2021 on a tight schedule“APT41 World Tour 2021 on a tight schedule”
-
Hunting In Memory“Winnti is yet another malware sample that uses the Memory Module technique.”
-
“We find many things that others do not even see”“I spoke about the Chinese group APT41 and how we investigated the group’s attacks.”
-
Big airline heist“…ttributed another previously unknown cyberattack on Air India with moderate confidence to the Chinese nation-state threat actor known as APT41.”
Indicators in its reports
named in the reports above- ns1.colunm[.]tkin 2 reports
- colunm[.]tkin 2 reports
- 185.118.166[.]66in 2 reports
- cs.colunm[.]tkin 2 reports
- dc.cathaypacifice[.]comin 2 reports
- net.dpworldto[.]comin 2 reports
- railway[.]comin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.