APT41 Profile: Espionage, Cybercrime and Intrusion Tradecraft
Summary
The profile describes APT41’s dual espionage and financially motivated activity, exploit-driven access, stealth and persistence techniques, campaigns including TOUGHPROGRESS’s Google Calendar C2, and recommended defenses.
Key points
- APT41 is described as a China-linked intrusion set associated with both state-aligned espionage and financially motivated cybercrime.
- The article links the group to exploitation of public-facing systems, including vulnerabilities CVE-2019-19781, CVE-2020-10189 and Log4Shell (CVE-2021-44228).
- Reported post-compromise techniques include abuse of native tools, credential theft, web shells, scheduled tasks and disguised Windows services.
- Google’s Threat Intelligence Group reported that TOUGHPROGRESS used Google Calendar events for covert command and control after spearphishing delivered a ZIP file.
- The article describes reported phishing targeting organizations involved in U.S.-China trade policy and diplomacy, including emails impersonating a U.S. congressman.
- Suggested defenses include patching and hardening internet-facing systems, phishing-resistant MFA, monitoring native-tool abuse and watching for suspicious cloud activity.
Article Details
- Topic
- APT41's dual-purpose intrusion operations, exploit-driven access, persistence, and covert command-and-control
MITRE ATT&CK
T1001.003 · Protocol or Service ImpersonationAPT41 concealed commands and exfiltrated data in Google Calendar event content to resemble routine cloud activity.T1003.001 · LSASS MemoryAPT41 used tools such as Mimikatz to dump credentials from LSASS memory.T1027 · Obfuscated Files or InformationAPT41 obfuscated and packed payloads, including using encoded stages.T1036.004 · Masquerade Task or ServiceAPT41 disguised services with names resembling legitimate components.T1041 · Exfiltration Over C2 ChannelAPT41 embedded exfiltrated data in its command-and-control traffic through Google Calendar.T1053.005 · Scheduled TaskAPT41 used scheduled tasks for recurring execution and persistence.T1059.001 · PowerShellAPT41 used PowerShell for payload staging and execution.T1071.001 · Web ProtocolsAPT41 used HTTP/HTTPS communications to blend activity with legitimate traffic.T1140 · Deobfuscate/Decode Files or InformationAPT41 decoded staged payloads with native tools such as certutil.T1190 · Exploit Public-Facing ApplicationAPT41 exploited public-facing applications and internet-facing systems to gain initial access.T1218.011 · Rundll32APT41 used rundll32 to execute payloads while blending with legitimate processes.T1505.003 · Web ShellAPT41 deployed long-lived web shells on exposed servers for command execution and follow-on payload delivery.T1543.003 · Windows ServiceAPT41 created or modified Windows services for persistence.T1566.001 · Spearphishing AttachmentAPT41 used targeted spearphishing with malicious attachments, including a ZIP delivered from a compromised government website.T1567.002 · Exfiltration to Cloud StorageAPT41 exfiltrated data to legitimate cloud storage services such as OneDrive.
CVE
CVE-2019-19781Citrix · Application delivery controller firmware; Citrix · Gateway firmware; +1 more[Vulnerabilities ] exploited CVEs used as access vectors – CVE-2019-19781 (Citrix NetScaler/ADC), CVE-2021-44228 (Log4Shell), and CVE-2020-10189 (Zoho ManageEngine)CVE-2020-10189Zohocorp · Manageengine desktop central[Vulnerabilities ] exploited CVEs used as access vectors – CVE-2019-19781 (Citrix NetScaler/ADC), CVE-2021-44228 (Log4Shell), and CVE-2020-10189 (Zoho ManageEngine)CVE-2021-44207Acclaimsystems · Usaherdssystems and third-party applications (including a livestock management system associated with CVE-2021-44207 (USAHerds)), as well as rapid exploitation behavior around Log4Shell during the same period.CVE-2021-44228Apache Software Foundation · Apache Log4j2to achieve execution (e.g., Log4Shell exploitation) (‘rapid exploitation of Log4Shell (CVE-2021-44228) shortly after disclosure’)
Threat Actors
Bronze AtlasThe article identifies Bronze Atlas as an alias used for APT41 in some vendor or intelligence-source reporting.Double DragonThe article identifies Double Dragon as an alias used for APT41 in some vendor or intelligence-source reporting.RedGolfThe article identifies Wicked Panda as an alias used for APT41 in some vendor or intelligence-source reporting.SPIRE CASTLEThe article describes APT41 as a China-linked intrusion set conducting state-aligned espionage and financially motivated cybercrime.Winnti GroupThe article identifies Winnti as an alias used for APT41 in some vendor or intelligence-source reporting.
Malware
Vendors
Citrix[Vulnerabilities ] exploited CVEs used as access vectors – CVE-2019-19781 (Citrix NetScaler/ADC), CVE-2021-44228 (Log4Shell), and CVE-2020-10189 (Zoho ManageEngine)GoogleThe group has exploited a range of public-facing systems and cloud services (including Log4Shell and Google Calendar-based C2) and has been tied to campaigns such as TOUGHPROGRESS and U.S.Zoho[Vulnerabilities ] exploited CVEs used as access vectors – CVE-2019-19781 (Citrix NetScaler/ADC), CVE-2021-44228 (Log4Shell), and CVE-2020-10189 (Zoho ManageEngine)
Products
Citrix NetScaler/ADC[Vulnerabilities ] exploited CVEs used as access vectors – CVE-2019-19781 (Citrix NetScaler/ADC), CVE-2021-44228 (Log4Shell), and CVE-2020-10189 (Zoho ManageEngine)Google CalendarThe group has exploited a range of public-facing systems and cloud services (including Log4Shell and Google Calendar-based C2) and has been tied to campaigns such as TOUGHPROGRESS and U.S.Microsoft OneDriveAPT41 has used unconventional C2 channels and cloud services to hide activity, including embedding encrypted commands in Google Calendar events and exfiltrating data to legitimate cloud storage like OneDrive.USAHerdsState Government Intrusions: USAHerds and Log4Shell Exploitation (2021-2022)Zoho ManageEngine Desktop Centralused enterprise and edge technologies, including Citrix NetScaler/ADC (CVE-2019-19781), Zoho ManageEngine Desktop Central (CVE-2020-10189), and rapid exploitation of Log4Shell (CVE-2021-44228) shortly after
Tools
Countries
ChinaAPT41 is a long-running, China-linked intrusion set that operates with a dual mission of state-aligned espionage and financially motivated cybercrime, using rapid vulnerability weaponization and long-dwell,ItalyThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.SpainThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.TaiwanThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.ThailandThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.TurkeyThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.United KingdomThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.United StatesThe group has exploited a range of public-facing systems and cloud services (including Log4Shell and Google Calendar-based C2) and has been tied to campaigns such as TOUGHPROGRESS and U.S.
Industries
AutomotiveThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.EducationAdditional reporting has linked APT41 activity to telecommunications, energy, healthcare, education, and even the video game industry, underscoring the group’s willingness to pursue targets that support bothEnergyAdditional reporting has linked APT41 activity to telecommunications, energy, healthcare, education, and even the video game industry, underscoring the group’s willingness to pursue targets that support bothGovernmentstate government intrusions.HealthcareAdditional reporting has linked APT41 activity to telecommunications, energy, healthcare, education, and even the video game industry, underscoring the group’s willingness to pursue targets that support bothMedia and entertainmentThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.Shipping and LogisticsThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.TechnologyThis includes global shipping and logistics, technology, media and entertainment, and automotive organizations, with victimology spanning countries such as Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom.TelecommunicationsAdditional reporting has linked APT41 activity to telecommunications, energy, healthcare, education, and even the video game industry, underscoring the group’s willingness to pursue targets that support bothvideo gamereporting has linked APT41 activity to telecommunications, energy, healthcare, education, and even the video game industry, underscoring the group’s willingness to pursue targets that support both intelligence