Loading malware…
PINEGROVE is a malware utility associated with APT41’s DUST intrusion activity. It has been observed alongside SQLULDR2 in operations focused on collecting local system and database information from compromised environments, particularly in intrusions involving Oracle database access and subsequent data theft. The tooling has been linked to campaigns that staged collected data locally, compressed it, and exfiltrated it to cloud storage services such as OneDrive. PINEGROVE appears to function as part of a broader post-compromise collection and exfiltration workflow rather than as an initial access mechanism. It has been referenced as an uploader within threat hunting detections, which is consistent with a role in transferring harvested information out of victim networks. Activity involving PINEGROVE has been attributed to APT41, a China-nexus espionage actor known for combining stealthy in-memory malware, web shells, signed components, and cloud-based command-and-control in enterprise intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used by APT41 (DUST) for local system and database information collection during intrusions.
Tool used to gather local system and database information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.