Procedure examples

APT41 used BITSAdmin to download and install payloads.

APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.

APT41 cloned victim user Git repositories during intrusions.

APT41 used compiled HTML (.chm) files for targeting.

APT41 has used rundll32.exe to execute a loader.

APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.

APT41 used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.

APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT41 leveraged sticky keys to establish persistence.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.

APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.

APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

APT41 has used DGAs to change their C2 servers monthly.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

APT41 uses remote shares to move and remotely execute payloads during lateral movemement.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. APT41 has also used legitimate executables to perform DLL side-loading of their malware.

APT41 has configured payloads to load via LD_PRELOAD.

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.

APT41 leverages various tools and frameworks to brute-force directories on web servers.

APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.

APT41 used `NATBypass` to bypass firewall restrictions and to access compromised systems via RDP.

APT41 impersonated an employee at a video game developer company to send phishing emails.

APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.