APT41

APT41 is a Chinese state-sponsored threat actor that conducts espionage aligned with Beijing's interests alongside financially motivated cybercrime. It is also known as Brass Typhoon, Wicked Panda, Barium, and Double Dragon. APT41 is frequently associated with the Winnti name, although the broader Winnti umbrella encompasses multiple Chinese threat groups with overlapping tools and activities rather than a single interchangeable identity. Its targets include government agencies, gaming and gambling organizations, software production environments, and online billing and payment services. APT41 exploited a zero-day vulnerability in the USAHERDS application to attack multiple U.S. state governments during 2021. Its financially motivated operations have included ransomware deployment, cryptojacking, and theft of video-game currency. Initial-access methods include spearphishing with compiled HTML attachments, exploitation of public-facing applications, software supply-chain compromise, and access through third-party VPN connections. Documented exploitation includes CVE-2020-10189 in Zoho ManageEngine Desktop Central and CVE-2019-19781 in Citrix appliances. The group has inserted malicious code into legitimate signed software distributed to end users. APT41 steals credentials through memory-based password-hash dumping and DCSync, using tools including Mimikatz and Windows Credential Editor. It uses compromised accounts and RDP for lateral movement, and establishes persistence through modified Windows services, scheduled tasks, and newly created accounts. Its toolkit includes Cobalt Strike and custom malware such as TIDYELF and WINTERLOVE. Defense-evasion methods include DLL hijacking, process injection, VMProtect-protected binaries, and abuse of legitimate administration utilities. The group profiles compromised systems, adapts to defensive activity, and stages targeted files in archives for exfiltration. It has also deployed Encryptor RaaS to encrypt victim files and demand ransom.