APT41 is a China-based group that mixes state-sponsored espionage with financially motivated crime, and it repeatedly turns stolen credentials, signing certificates and trusted software into its way in. It exploits internet-facing applications within hours of disclosure, compromises software build environments, signs malware with stolen certificates and hides command and control inside legitimate cloud services such as Google Workspace, Google Calendar, OneDrive and Cloudflare. This profile is for security operations, threat intelligence, application and identity teams, particularly in technology, gaming, healthcare, telecoms, logistics, media and government. It covers the group's names, targeting, ATT&CK techniques, identity and secrets abuse, notable incidents and the controls that break its playbook. It complements the broader Threat Actor Groups Guide, which compares many groups; this page goes deep on one. Facts are stated as of October 2026, based on sources available.
Key takeaways
- Dual mission. MITRE describes APT41 as assessed Chinese state-sponsored espionage that also conducts financially motivated operations, active since at least 2012 across at least 14 countries.
- Fast exploitation of exposed applications. Mandiant observed Log4Shell exploitation within hours of the December 2021 advisory, and a zero-day in a US state government application, with re-compromise two weeks after containment.
- Machine identities are a favourite target. Shared ASP.NET machineKey values, stolen code-signing certificates, compromised Google Workspace accounts and OneDrive tokens all feature in public reporting.
- Trusted channels hide the traffic. Command and control has run through GitHub and Pastebin dead drops, Cloudflare Workers, Google Sheets, Google Drive and Google Calendar events.
- Remediation must be complete. The group returns through a second vector or a sister agency, so incident response must rotate every credential and key it could have reached, not just close the first hole.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as APT41 (G0096), with associated names Wicked Panda, Brass Typhoon and BARIUM, and notes partial overlap with public reporting on Winnti Group (G0044). Google's 2025 reporting also uses the name HOODOO. In September 2020 the US Department of Justice announced charges against five Chinese nationals, including employees of Chengdu 404 Network Technology, and two Malaysian nationals accused of helping to monetise access, in cases linked to APT41 activity. The defendants are presumed innocent unless proven guilty.
| Name | Used by | Notes |
|---|---|---|
| APT41 (G0096) | MITRE ATT&CK, Mandiant, Google | Primary public name; campaigns C0017 and C0040 (APT41 DUST) attributed |
| Brass Typhoon (formerly BARIUM) | Microsoft | Listed by MITRE as associated |
| Wicked Panda | CrowdStrike | Listed by MITRE as associated |
| Winnti Group (G0044) | Multiple vendors | Partial overlap only; Operation CuckooBees (C0012) is attributed to actors affiliated with Winnti, APT41 and BARIUM |
| HOODOO | Google Threat Intelligence Group | Used alongside APT41 in 2025 reporting |
Targeting and motivation
- Espionage: MITRE lists healthcare, telecoms, technology, finance, education and retail. The DOJ case lists software developers, hardware makers, telecoms, social media, universities, think tanks, foreign governments and pro-democracy figures in Hong Kong, with government networks in India and Vietnam compromised.
- Financial gain: The DOJ alleged ransomware against a global anti-poverty non-profit, cryptojacking and fraud against video game companies by generating and selling in-game currency.
- Government and public sector: Mandiant's campaign C0017 compromised at least six US state government networks between May 2021 and February 2022, with exfiltration of personal data observed.
- Logistics and media: APT41 DUST (2023 to July 2024) hit shipping, logistics, media and entertainment, technology and automotive organisations in Italy, Spain, Taiwan, Thailand, Turkey and the UK. Google's May 2025 report lists governments plus shipping, logistics, media, technology and automotive.
Tactics and techniques (MITRE ATT&CK)
| Tactic | Technique | Reported behaviour |
|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application | Citrix ADC CVE-2019-19781, ManageEngine Desktop Central CVE-2020-10189, Exchange CVE-2021-26855, Log4j CVE-2021-44228, USAHerds CVE-2021-44207, SQL injection and .NET deserialisation |
| Initial access | T1195.002 Compromise Software Supply Chain | Malicious code injected into legitimate, signed files distributed to customers |
| Initial access | T1133 External Remote Services | VPN link between a third-party provider and a payment service |
| Initial access | T1566.002 Spearphishing Link | Spear-phishing links to ZIP files with .lnk files disguised as PDFs (2024 to 2025) |
| Persistence | T1505.003 Web Shell, T1543.003 Windows Service | ANTSWORD and BLUEBEAM web shells on Tomcat; a service named Windows Defend |
| Stealth | T1553.002 Code Signing, T1574.001 DLL | Malware signed with stolen gaming-company certificates; DLL search order hijacking and side-loading |
| Credential access | T1003.001, T1003.002, T1003.003 | LSASS dumping, SAM and SYSTEM hive copies, NTDS.dit extraction |
| Credential access | T1110 Brute Force, T1555.003 Credentials from Web Browsers | Brute force of local admin accounts; browser password theft |
| Lateral movement | T1550.002 Pass the Hash, T1021.002 SMB/Windows Admin Shares | Captured hashes and admin shares used to move between hosts |
| Command and control | T1102.001 Dead Drop Resolver, T1102 Web Service | GitHub, Pastebin, Microsoft TechNet, Cloudflare Workers, Google Calendar |
| Command and control | T1071.004 DNS, T1568.002 Domain Generation Algorithms | DNS-based C2 and exfiltration; monthly DGA rotation |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Oracle database exports uploaded to OneDrive |
How they abuse identities and credentials
APT41 targets both human credentials and the non-human identities that software and services depend on. The second category is where many defenders are weakest.
Application secrets and shared keys
- Static ASP.NET machineKey: Mandiant found USAHerds, used by 18 US states, shipped with the same validationKey and decryptionKey in every installation, so knowing one key opened every internet-exposed instance through ViewState deserialisation. CISA's KEV catalogue lists CVE-2021-44207 as use of hard-coded credentials. The same class of failure appears in the ToolShell SharePoint exploitation of 2025, where stolen machine keys kept a different actor inside after patching.
- Configuration files: In a 2020 incident Mandiant saw directory traversal used to read web.config before forging ViewState payloads. Keys in configuration files are secrets and need the same rotation and protection. See the Secrets Management Guide.
Signing certificates and build systems
- Stolen code-signing certificates: The DOJ alleged theft of code-signing certificates; Mandiant's 2024 DUST report shows malware signed with certificates issued to CCR INC, OOO ALEAN-TOUR and Gala Lab Corp. See the Code Signing Security Guide.
- Build pipeline access: MITRE records APT41 gaining access to production environments to inject code into legitimate signed files. Build service accounts and signing keys are therefore crown-jewel identities. See the Software Supply Chain Security Guide.
Cloud accounts and tokens
- Compromised Workspace accounts: DUSTTRAP command traffic used compromised Google Workspace accounts (T1586.003) to blend with normal use.
- Stored OAuth credentials: The PINEGROVE uploader read OneDrive credentials from a local auth.json file to exfiltrate data, so API credentials held on servers become exfiltration channels.
- Attacker-owned cloud tenants: TOUGHPROGRESS polled Google Calendar events for encrypted commands; Google says it built fingerprints to find and remove those calendars.
Windows and Active Directory credentials
- Local and domain credentials: SAM and SYSTEM hive copies, Mimikatz, NTDS.dit theft, pass the hash and new local accounts added to admin groups. Operation CuckooBees used compromised domain administrator credentials. See the Credential Dumping Guide.
Notable incidents
| Period | Activity | Source |
|---|---|---|
| Up to 2020 | Intrusions at more than 100 organisations; supply chain compromises; video game fraud; ransomware; exploitation of CVE-2019-19781, CVE-2019-11510 and CVE-2020-10189 | US DOJ, 16 September 2020 |
| May 2021 to February 2022 | Campaign C0017: at least six US state governments via USAHerds zero-day and Log4j; Cloudflare Workers C2; DNS exfiltration; re-compromise after remediation | Mandiant, March 2022; MITRE C0017 |
| 2019 to 2022 | Operation CuckooBees: theft of intellectual property from technology and manufacturing companies, attributed to Winnti, APT41 and BARIUM affiliates | MITRE C0012 |
| 2023 to July 2024 | APT41 DUST: web shells on Tomcat, DUSTPAN and DUSTTRAP, Oracle data exported to OneDrive, stolen gaming certificates | Mandiant, July 2024; MITRE C0040 |
| October 2024 to 2025 | TOUGHPROGRESS malware using Google Calendar for C2; payloads hosted on Cloudflare Workers, TryCloudflare and InfinityFree since at least August 2024 | Google Threat Intelligence Group, May 2025 |
No later APT41 activity is included here because it could not be confirmed from a primary source at the time of writing.
Detection and defence
Controls mapped to the playbook
| Actor behaviour | Control | Framework reference |
|---|---|---|
| Rapid exploitation of web apps and appliances | Asset inventory of internet-facing apps; patch KEV entries in days; WAF virtual patching while waiting | NIST SP 800-53 RA-5, SI-2; CSF 2.0 ID.RA-01, PR.PS-02 |
| Shared or hard-coded application keys | Unique per-instance machineKey and secrets; rotate after any compromise or vendor default | SP 800-53 IA-5 |
| Build and signing compromise | Signing keys in HSMs; isolated build systems; provenance checks on releases | SP 800-53 SR-3, SR-4; CSF 2.0 GV.SC-07 |
| Credential dumping and pass the hash | Credential Guard and LSA protection; unique local admin passwords; tiered admin accounts | SP 800-53 AC-6, AC-2 |
| C2 through cloud services and DNS | Egress control and DNS logging; review of unsanctioned cloud tenants | SP 800-53 SC-7, SI-4; CSF 2.0 DE.CM-01 |
| Re-entry after remediation | Full-scope eradication, credential rotation and post-incident monitoring | SP 800-53 IR-4 |
What to log and hunt for
- Web servers: new .aspx or .jsp files under web roots and Tomcat Manager deployments; w3wp.exe or java spawning cmd.exe, powershell.exe or certutil.exe; ViewState validation errors in application logs.
- Credential access: reg.exe saving HKLM\SAM or HKLM\SYSTEM, ntdsutil use, access to lsass.exe by unusual processes.
- Persistence: Windows services with system-sounding names (Event ID 7045), modified scheduled tasks, unsigned DLLs loaded from application folders.
- Certificates: binaries signed by publishers that have no business relationship with you, especially gaming companies, and revoked certificates.
- Network and cloud: long hex-encoded DNS subdomains, workers.dev and trycloudflare.com traffic from servers, OneDrive or Google API calls from hosts that should not use them, and large database exports compressed with RAR.
Detection engineering patterns are expanded in the Threat Hunting Guide and the Living off the Land Guide.
Metrics
- Median days to remediate KEV vulnerabilities on internet-facing systems.
- Percentage of internet-facing applications with unique, rotated application keys (no vendor defaults).
- Percentage of code-signing keys held in HSMs with signing logged and reviewed.
- Percentage of servers with unique local admin passwords and Credential Guard or LSA protection.
- Number of servers allowed direct egress to cloud storage and serverless platforms (trend toward zero).
Practitioner checklist
- Inventory every internet-facing web application, including niche vendor software, and subscribe to its security advisories.
- Patch KEV-listed flaws on exposed systems within days, and hunt for web shells after patching rather than assuming patching evicted the attacker.
- Replace any shared or vendor-default machineKey, API key or connection string with unique per-instance values, and rotate them after any incident.
- Move code-signing keys into HSMs or a managed signing service, restrict who can sign, and monitor for your certificates appearing on unknown binaries.
- Deploy unique local administrator passwords and Credential Guard, and separate domain admin accounts from daily use.
- Restrict server egress to known destinations and log DNS so that Cloudflare Workers, Google Calendar or OneDrive traffic from servers stands out.
- When responding, assume a second foothold: rotate domain, service and application credentials, check sister business units and monitor closely for weeks. See the Incident Response Guide.
- Feed MITRE, CISA and vendor reporting on APT41 into detection content, following the Threat Intelligence Guide.
Standards and references
- MITRE ATT&CK: APT41 (G0096)
- MITRE ATT&CK: Campaign C0017
- MITRE ATT&CK: APT41 DUST (C0040)
- US Department of Justice: Seven International Cyber Defendants, Including APT41 Actors, Charged
- Mandiant: APT41 targeting US state governments
- Mandiant: APT41 DUST campaign report
- Google Threat Intelligence Group: APT41 innovative tactics and Google Calendar C2
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Edge Device Security Guide · Web Application Attacks Guide · Persistence Techniques Guide