Loading story…
The U.S. Department of Justice charged seven international defendants, including five alleged members of APT41, over computer intrusion campaigns that hit more than 100 victims worldwide. Prosecutors said the group targeted universities, software developers, telecommunications providers, social media companies, video game firms, nonprofits, and foreign governments, stealing source code, customer account data, and personally identifiable information while pursuing both espionage and financial gain. The indictments describe activity ranging from supply-chain compromises and credential theft to fraud involving in-game currency and other monetization schemes.
Reporting tied the charged activity to broader APT41 operations, including ColdLock ransomware attacks against Taiwanese organizations, especially in the energy sector. In those intrusions, attackers were observed using Active Directory Group Policy, scheduled tasks, SMB, PowerShell, customized loaders, and Cobalt Strike to move laterally and deploy ransomware. Trend Micro said related activity also affected energy, retail, and telecommunications organizations in Southeast Asia, with infrastructure overlaps and targeting patterns suggesting links between criminal operations and Chinese state-aligned espionage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On September 16, 2020, the U.S. Justice Department announced charges against five Chinese citizens tied to APT41 for hacking crimes connected to global intrusion campaigns. The department also said two Malaysian citizens were arrested for aiding the hackers, while the five Chinese nationals remained fugitives.
Trend Micro identified overlapping indicators and command-and-control infrastructure suggesting related incidents affecting energy, retail, and telecom companies, mainly in Southeast Asia. The company also observed password-dumping and HTTP tunneling tools used before ransomware deployment about one month later.
Trend Micro investigated a ColdLock ransomware incident affecting the energy industry in Taiwan. In that case, the attackers used compromised Active Directory credentials, modified Group Policy Objects to push scheduled tasks, spread via SMB and an internal IIS service, and deployed customized loaders and Cobalt Strike.
According to the indictments described by the Justice Department, APT41 targeted more than 100 institutions in the United States and abroad, including video game companies, telecommunications firms, universities, non-profits, and software providers. The campaign involved espionage and profit-driven activity, including theft of source code, customer account data, and personally identifiable information.
4 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcejustice.gov
Open sourcesymantec-enterprise-blogs.security.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google-owned Mandiant detailed how **APT41**, a China-linked threat group also known as **Double Dragon**, continues to blend state-aligned espionage with financially motivated intrusions. The reporting describes a long-running operation in which the group targets organizations across multiple sectors and geographies while using a broad toolkit of malware, compromised infrastructure, and hands-on-keyboard tradecraft to steal data, maintain persistence, and support intelligence collection. Mandiant said APT41 stands out because it operates at the intersection of **nation-state espionage** and **cybercrime**, shifting between strategic targeting and profit-driven activity without separating the two missions. The group has been tied to intrusions affecting enterprises worldwide and remains notable for its adaptability, operational scale, and ability to exploit trusted environments to advance both theft and surveillance objectives.
Jul 12, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026
The U.S. Department of Justice unsealed charges against three alleged North Korean military hackers tied to the Reconnaissance General Bureau, identifying them as members of the **Lazarus Group/APT38** behind a years-long campaign of cyberattacks and financial crime. Prosecutors linked the defendants to the 2014 **Sony Pictures** intrusion, SWIFT-enabled bank theft attempts including the Bangladesh Bank case, **FASTCash** ATM cash-out operations, the **WannaCry 2.0** ransomware outbreak, spear-phishing, and the **AppleJeus** cryptocurrency malware scheme. Authorities said the operations targeted banks, cryptocurrency businesses, and other organizations worldwide, with attempted thefts and losses totaling roughly **$1.3 billion**. Security and law-enforcement reporting described a broad Lazarus toolkit used across those operations, including malware such as **Trojan.Banswift**, **Backdoor.Contopee**, **Downloader.Ratankba**, **Trojan.Fastcash**, and AppleJeus variants, while WannaCry was noted to have spread via **EternalBlue** against Windows flaws including `CVE-2017-0144` and `CVE-2017-0145`. The case also connected North Korean operators to laundering networks and later cryptocurrency theft activity, including the FBI’s attribution of the **$100 million Harmony Horizon Bridge** theft to Lazarus and its **TraderTraitor** campaign. U.S. authorities said they seized about **$1.9 million** in stolen cryptocurrency, issued victim notifications and joint guidance, and continued efforts to trace and freeze assets used to fund Pyongyang’s weapons programs.
Aug 15, 2026