APT41

Also known as: Wicked Panda · Brass Typhoon · BARIUM

Overview

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Targets

Automotive · Business · Cryptocurrency · Education · Energy · Finance · Healthcare · High-Tech · Intergovernmental · Media · Pharmaceuticals · Private sector · Retail · Services · Telecommunications · Travel

Regions

China · France · Hong Kong · India · Italy · Japan · Myanmar · Netherlands · Singapore · South Africa · South Korea · Switzerland · Thailand · Turkey · United Kingdom · United States

Capabilities

Supply-chain compromise — ATT&CK T1195.002
Exploitation of public-facing / client applications — ATT&CK T1190, T1203
Custom malware/implant development — ATT&CK: 18 attributed custom malware families

TTPs — 82 techniques across 15 tactics

Reconnaissance

T1595.002 Vulnerability Scanning
T1595.003 Wordlist Scanning
T1596.005 Scan Databases

Resource Development

T1588.002 Tool

Defense Impairment

Credential Access

T1003.001 LSASS Memory
T1003.002 Security Account Manager
T1003.003 NTDS
T1110 Brute Force
T1555 Credentials from Password Stores
T1555.003 Credentials from Web Browsers

Discovery

T1012 Query Registry
T1016 System Network Configuration Discovery
T1018 Remote System Discovery
T1033 System Owner/User Discovery
T1046 Network Service Discovery
T1049 System Network Connections Discovery
T1069 Permission Groups Discovery
T1082 System Information Discovery
T1083 File and Directory Discovery
T1087.001 Local Account
T1087.002 Domain Account
T1135 Network Share Discovery

Lateral Movement

Collection

T1005 Data from Local System
T1056.001 Keylogging
T1213.003 Code Repositories
T1560.001 Archive via Utility

Command and Control

T1008 Fallback Channels
T1071.001 Web Protocols
T1071.002 File Transfer Protocols
T1071.004 DNS
T1090 Proxy
T1102.001 Dead Drop Resolver
T1104 Multi-Stage Channels
T1105 Ingress Tool Transfer
T1568.002 Domain Generation Algorithms

Exfiltration

T1030 Data Transfer Size Limits

Impact

T1486 Data Encrypted for Impact
T1496.001 Compute Hijacking

Tools & malware (32)

ASPXSpy · BITSAdmin · PlugX · Impacket · gh0st RAT · netstat · PowerSploit · ZxShell · KEYPLUG · Ping · LightSpy · DUSTPAN · Net · ipconfig · sqlmap · China Chopper · ShadowPad · MESSAGETAP · Mimikatz · certutil · njRAT · Empire · Cobalt Strike · pwdump · BLACKCOFFEE · MOPSLED · ROCKBOOT · dsquery · Winnti for Linux · DUSTTRAP · Derusbi · ftp

Reporting (3)

How Microsoft names threat actors — Microsoft
Big airline heist APT41 likely behind a third-party attack on Air India — Rostovcev, N
2020 Global Threat Report — Crowdstrike