Procedure examples

APT41 DUST used encrypted payloads decrypted and executed in memory.

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

APT41 DUST deleted various artifacts from victim systems following use.

APT41 DUST used HTTPS for command and control.

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.

APT41 DUST used compromised Google Workspace accounts for command and control.

APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.

APT41 DUST collected data from victim Oracle databases using SQLULDR2.

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.

APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.

APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.

APT41 DUST exfiltrated collected information to OneDrive.

APT41 DUST used Windows services to execute DUSTPAN.

APT41 DUST used HTTPS for command and control.

APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP. APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.

APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.

APT41 DUST used compromised Google Workspace accounts for command and control.

APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.

APT41 DUST involved use of search engines to research victim servers.

APT41 DUST involved access of external victim websites for target development.

APT41 DUST used internet scan data for target development.