APT41 intrusion activities originating from China are being detected again. Earlier this year, APT41 launched a global intrusion campaign using multiple exploits. These recent computer intrusions are affecting more than 100 victim companies and organizations globally. These computer network exploitation (CNE) operations are mainly targeting the following industries:
The group is known for having conducted numerous computer intrusions as well as criminal for-profit computer fraud on a global scale, using sophisticated tradecraft against a variety of targets, such as compromising legitimate software for supply chain intrusions, using custom malware, deploying ransomware, and engaging in crypto-jacking attacks. Spearphishing emails with malicious files is a common tactic for the initial infection. Spearphishing themes frequently target HR departments with malicious archive files masqueraded as applicant resumes. In addition, the group conducted supply chain compromises resulting in the victimization of third-party customers throughout the world. They steal login credentials for administrative accounts to expand their unauthorized access. Additionally, the actors may deploy legitimate third-party VPN software such as SoftEther on victim networks to facilitate follow-on access to the victim network. The group has also deployed “Skeleton Key” malware to create a master password that will work for any account in the domain.
The group is also known for rapidly exploiting publicly identified security vulnerabilities. This technique allowed the group to gain access into victim accounts using publicly available exploit code against VPN services. Security vulnerabilities such as CVE-2019-19781, CVE-2019-11510, CVE-2019-16920, CVE-2019-16278, CVE-2019-1652/CVE-2019-1653, and CVE-2020-10189 were exploited for installation of widely available remote access tools like Cobalt Strike.