Procedure examples

APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.

APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.

APT41 has uploaded files and data from a compromised host.

APT41 used the Steam community page as a fallback mechanism for C2.

APT41 queried registry values to determine items such as configured RDP ports and network configurations.

APT41 deployed rootkits on Linux systems.

APT41 collected MAC addresses from victim machines.

APT41 has used MiPing to discover active systems in the victim network.

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

APT41 has transferred implant files using Windows Admin Shares and the Server Message Block (SMB) protocol, then executes files through Windows Management Instrumentation (WMI).

APT41 used VMProtected binaries in multiple intrusions.

APT41 uses packers such as Themida to obfuscate malicious files.

APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.

APT41 has created services to appear as benign system tools.

APT41 attempted to masquerade their files as popular anti-virus software.

APT41 used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` rootkit.

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

APT41 used a compromised account to create a scheduled task on a system.

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

APT41 used a keylogger called GEARSHIFT on a target system.

APT41 leveraged PowerShell to deploy malware families in victims’ environments.

APT41 used cmd.exe /c to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.

APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.

APT41 used net group commands to enumerate various Windows user groups and permissions.

APT41 attempted to remove evidence of some of its activity by deleting Bash histories.

APT41 deleted files from the system.

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.

APT41 used exploit payloads that initiate download via ftp.

APT41 used DNS for C2 communications.

APT41 used compromised credentials to log on to other systems.

APT41 uses multiple built-in commands such as systeminfo and `net config Workstation` to enumerate victim system basic configuration information.

APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.

APT41 used built-in net commands to enumerate local administrator groups.

APT41 used built-in net commands to enumerate domain administrator users.

APT41 used a tool called CLASSFON to covertly proxy network communications.

APT41 has added user accounts to the User and Admin groups.

APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.

APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

APT41 performed password brute-force attacks on the local admin account.

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.

APT41 used the net share command as part of network reconnaissance.

APT41 has created user accounts.

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.