APT41
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT41Our name
- Wicked PandaCrowdStrike
- BARIUMMicrosoft
- Brass TyphoonMicrosoft
Targets
Sectors: Healthcare, Finance, Telecommunications, Education, Retail
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1003.003NTDS
- T1005Data from Local System
- T1008Fallback Channels
- T1012Query Registry
- T1014Rootkit
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1021.002SMB/Windows Admin Shares
- T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1030Data Transfer Size Limits
- T1033System Owner/User Discovery
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1037Boot or Logon Initialization Scripts
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1055Process Injection
- T1056.001Keylogging
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.004Unix Shell
- T1069Permission Groups Discovery
- T1070.003Clear Command History
- T1070.004File Deletion
- T1071.001Web Protocols
- T1071.002File Transfer Protocols
- T1071.004DNS
- T1078Valid Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1090Proxy
- T1098.007Additional Local or Domain Groups
Malware and tools used
ASPXSpyBITSAdminBLACKCOFFEEcertutilChina ChopperCobalt StrikeDerusbidsqueryDUSTPANDUSTTRAPEmpireftpgh0st RATImpacketipconfigKEYPLUGLightSpyMESSAGETAPMimikatzMOPSLEDNetnetstatnjRATPingPlugXPowerSploitpwdumpROCKBOOTShadowPadsqlmapWinnti for LinuxZxShell
Source: MITRE ATT&CKRecent news
No stories yet.