Threat-actor profile

← Back to main site

Home/ Threat Actors/ APT41

🇨🇳APT41

🇨🇳 APT41 is a tracked threat actor in the Clankerusecase corpus. Attributed to CN. Primary motivation: State. We map 26 detection use cases to this actor across 100 MITRE ATT&CK techniques, with 2 threat-intel articles citing them. Active in our corpus from 2026-02-26 to 2026-05-07.

crit 2

View full actor card → All threat actors MITRE ATT&CK group spec (G0096) ↗

26Use cases

2Articles

100Techniques

9IOCs

Known aliases

APT41BARIUMWicked PandaWinnti GroupBrass TyphoonDouble DragonBlackfly

Top techniques

T1059.001 · PowerShell T1190 · Exploit Public-Facing Application T1071.001 · Web Protocols

All other tracked techniques

T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1003.002 · Security Account Manager T1003.003 · NTDS T1005 · Data from Local System T1008 · Fallback Channels T1012 · Query Registry T1014 · Rootkit T1016 · System Network Configuration Discovery T1018 · Remote System Discovery T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1027 · Obfuscated Files or Information T1027.002 · Software Packing T1030 · Data Transfer Size Limits T1033 · System Owner/User Discovery T1036.004 · Masquerade Task or Service T1036.005 · Match Legitimate Resource Name or Location T1037 · Boot or Logon Initialization Scripts T1046 · Network Service Discovery T1047 · Windows Management Instrumentation T1049 · System Network Connections Discovery T1053.005 · Scheduled Task T1055 · Process Injection T1056.001 · Keylogging T1057 · Process Discovery T1059.003 · Windows Command Shell T1059.004 · Unix Shell T1059.005 · Visual Basic T1069 · Permission Groups Discovery T1069.002 · Domain Groups T1070.003 · Clear Command History T1070.004 · File Deletion T1071 · Application Layer Protocol T1071.002 · File Transfer Protocols T1071.004 · DNS T1078 · Valid Accounts T1082 · System Information Discovery T1083 · File and Directory Discovery T1087.001 · Local Account T1087.002 · Domain Account T1090 · Proxy T1090.002 · External Proxy T1098.007 · Additional Local or Domain Groups T1102.001 · Dead Drop Resolver T1104 · Multi-Stage Channels T1105 · Ingress Tool Transfer T1110 · Brute Force T1112 · Modify Registry T1127.001 · MSBuild T1133 · External Remote Services T1135 · Network Share Discovery T1136.001 · Local Account T1195.002 · Compromise Software Supply Chain T1197 · BITS Jobs T1203 · Exploitation for Client Execution T1204.001 · Malicious Link T1204.002 · Malicious File T1204.004 · Malicious Copy and Paste T1213.003 · Code Repositories T1218 · System Binary Proxy Execution T1218.001 · Compiled HTML File T1218.011 · Rundll32 T1219 · Remote Access Tools T1480.001 · Environmental Keying T1484.001 · Group Policy Modification T1486 · Data Encrypted for Impact T1496.001 · Compute Hijacking T1542.003 · Bootkit T1543.003 · Windows Service T1546.008 · Accessibility Features T1547.001 · Registry Run Keys / Startup Folder T1550.002 · Pass the Hash T1553.002 · Code Signing T1555 · Credentials from Password Stores T1555.003 · Credentials from Web Browsers T1560.001 · Archive via Utility T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1570 · Lateral Tool Transfer T1572 · Protocol Tunneling T1573.002 · Asymmetric Cryptography T1574.001 · DLL T1574.002 · T1574.002 T1574.006 · Dynamic Linker Hijacking T1583.001 · Domains T1588.002 · Tool T1595.002 · Vulnerability Scanning T1595.003 · Wordlist Scanning T1596.005 · Scan Databases T1599 · Network Boundary Bridging T1684.001 · Impersonation T1685 · Disable or Modify Tools T1685.005 · Clear Windows Event Logs

Detection use cases (26)

APT41 (Wicked Panda / Brass Typhoon) IIS post-exploitation: w3wp.exe spawning LOLBins after webshell drop AI · profile SΣDD APT41 DUSTTRAP / DodgeBox DLL side-loading: legitimately-signed third-party binary relocated to a writable path with same-folder DLL load an AI · profile SDD CL-STA-1132 EarthWorm staging download from 146.70.100.69:8000/php_sess Bespoke Malformed CL-STA-1132 attacker User-Agent (Mozilla/5.5 + Safari/532.31) Bespoke PAN-OS firewall service account LDAP enumeration of DomainDnsZones Bespoke Beaconing — periodic outbound to small set of destinations Internal Network connections to article IPs / domains Internal LSASS process access / dump (credential theft) Internal Asset exposure — vulnerability matches article CVE(s) Internal Remote service execution — PsExec / SMB lateral movement Internal PowerShell encoded / obfuscated command Internal RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal File hash IOCs — endpoint file/process match Internal Article-specific behavioural hunt — Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Internal 1Password failed sign-in burst MITRE match 1Password impossible-travel sign-in MITRE match 1Password item exfiltration attempt MITRE match 1Password vault export attempted MITRE match Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match

Threat-intel articles (2)

crit Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution · 2026-05-07

crit PlugX Meeting Invitation via MSBuild and GDATA · 2026-02-26

Tracked indicators

Domains (5)

decoorat.net decoraat.net gesecole.net onedow.gesecole.net onedown.gesecole.net

IP addresses (4)

136.0.8.48 146.70.100.69 149.104.66.84 67.206.213.86

CVEs (1)

CVE-2026-0300