FireEye APT41 March 2020

APT41 used VMProtected binaries in multiple intrusions.

APT41 leveraged PowerShell to deploy malware families in victims’ environments.

APT41 used cmd.exe /c to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.

APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.

APT41 used exploit payloads that initiate download via ftp.

APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.

APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.

APT41 used BITSAdmin to download and install payloads.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.