APT41
Also known as: Wicked Panda, Brass Typhoon, BARIUM, Winnti (overlapping)
APT41 is unusual for mixing state espionage with crime for profit. It has stolen source code and code-signing certificates, compromised software supply chains, and attacked video game companies for in-game currency, while also running espionage against governments. It is fast to weaponise newly disclosed web application vulnerabilities.
- Public attribution
- Assessed by researchers as a Chinese state-sponsored group that also conducts financially motivated operations; in 2020 the US Department of Justice charged five Chinese nationals over intrusions tracked as APT41.
- Active since
- Around 2012
- Targets
- Healthcare, telecommunications and technology
- Video game companies
- Government, including US state governments
- Organisations in at least 14 countries
Notable campaigns
2020US charges against APT41 actors
The DOJ charged defendants over intrusions at more than 100 victims, including theft of source code, code-signing certificates and customer data.
2021-2022US state government intrusions
Mandiant reported at least six US state government networks compromised, including through a zero-day in the USAHerds application (CVE-2021-44207) and Log4j.
Signature ATT&CK techniques
- T1190Exploit Public-Facing Application
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain
- T1505.003Server Software Component: Web Shell
- T1553.002Subvert Trust Controls: Code Signing
- T1574.001Hijack Execution Flow: DLL
- T1197BITS Jobs
- T1003.001OS Credential Dumping: LSASS Memory
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Patch internet-facing web applications fast and keep an inventory so you know where a newly disclosed library (such as Log4j) is used.
- Monitor web servers for new or modified script files that could be web shells.
- Store code-signing keys in hardware security modules and limit who can sign.
- Use application allowlisting and alert on DLL sideloading from unusual paths.