Apt41 Double Dragon

APT41 (Double Dragon, Wicked Panda, BARIUM) — Adversary Emulation Profile

APT41 (MITRE ATT&CK G0096; also tracked as Double Dragon, Wicked Panda, Winnti, BARIUM, and Microsoft's Brass Typhoon) is a prolific Chinese threat actor unique for running state-sponsored cyber-espionage in parallel with financially motivated cybercrime — often reusing the same non-public malware for both missions. First publicly profiled by FireEye/Mandiant in August 2019, the group has been active since at least 2012, beginning in the video-game economy (virtual-currency theft, ransomware, code-signing certificate theft) and expanding into wide-ranging espionage. APT41 is best known for software supply-chain compromises (poisoning legitimately signed installers), rapid weaponization of newly disclosed vulnerabilities, abuse of stolen code-signing certificates, and a deep, modular toolset spanning Windows and Linux. This profile maps APT41's documented TTPs to ATT&CK so Decepticon can emulate them under authorized scope and the blue cell can anticipate detection.

Attribution & motivation

• Suspected sponsor / nation: People's Republic of China. Mandiant assesses APT41 operates under the MSS (Ministry of State Security) contractor model — nominally private companies executing intelligence taskings for provincial MSS bureaus — rather than the PLA model. The group is operationally linked to the Chengdu-based front company Chengdu 404 Network Technology Co., Ltd.
• Motivation: Dual-mandate. Espionage (intellectual property, strategic intelligence, surveillance of dissidents/pro-democracy figures) interleaved with financial gain (game virtual-currency manipulation, ransomware, cryptomining). Mandiant observed espionage during Beijing business hours and financially motivated activity during off-hours, suggesting moonlighting on shared infrastructure.
• Confidence: High for China nexus and dual motivation. The U.S. DOJ on September 16, 2020 indicted five Chinese nationals (Zhang Haoran, Tan Dailin, Jiang Lizhi, Qian Chuan, Fu Qiang) and two Malaysian accomplices (Wong Ong Hua, Ling Yang Ching) in connection with attacks on 100+ victims globally, lending strong public attribution. Specific operation-to-operator mapping within individual intrusions carries lower confidence.

Targeting

• Sectors: Video games & game publishers, software/IT and computer hardware, telecommunications (incl. call-record interception), healthcare & pharmaceuticals, high-tech/semiconductors, media & entertainment, shipping & logistics, automotive, financial services, education, think tanks, and government.
• Regions: Global — North America, Europe (Italy, Spain, UK), East and Southeast Asia (Taiwan, Thailand, Hong Kong, Japan, South Korea), the Middle East (Turkey), and beyond. U.S. state governments were a notable target.
• Victim profile: Both broad opportunistic compromise (any org running a freshly exploitable internet-facing app) and deliberate strategic targeting. Notably includes Hong Kong pro-democracy activists and politicians and individuals of intelligence interest, alongside large enterprises and supply-chain "watering hole" vendors used to reach downstream customers.

Notable campaigns

• 2012–2019 — Video-game economy & supply-chain origins. Members conducted financially motivated game-currency theft and ransomware, then injected malicious code into legitimately signed software. APT41 is associated with the CCleaner (2017) and ASUS Live Update / "Operation ShadowHammer" (2018) supply-chain compromises and the ShadowPad privately-sold backdoor. (FireEye/Mandiant 2019; Kaspersky Securelist; SentinelLabs)
• August 2019 — Public attribution. FireEye publishes "APT41: A Dual Espionage and Cyber Crime Operation," formally naming the group and documenting its dual mandate. (Mandiant)
• Jan–Mar 2020 — Global exploitation wave. Mandiant observed APT41 attempt to exploit Citrix NetScaler/ADC (CVE-2019-19781), Cisco routers, and Zoho ManageEngine Desktop Central (CVE-2020-10189) across 75+ customers — one of the broadest campaigns by a Chinese actor observed at the time. (Mandiant)
• September 16, 2020 — DOJ indictments. U.S. charges seven defendants ("APT41 actors") for intrusions against 100+ organizations; FBI adds five to Cyber's Most Wanted. (DOJ / TechCrunch / BleepingComputer)
• May 2021 – Feb 2022 (Campaign C0017) — U.S. state government networks. APT41 compromised at least six U.S. state governments by exploiting internet-facing web apps, including a zero-day in the USAHerds livestock application (CVE-2021-44207) and Log4j (CVE-2021-44228) within hours of disclosure; deployed custom loaders (DEADEYE), KEYPLUG, and DUSTPAN. (Mandiant, "APT41 Targeting U.S. State Government Networks")
• Jan 2023 – Jun 2024 (Campaign C0040, "APT41 DUST") / July 2024 report — DUSTTRAP campaign. Sustained intrusions into shipping/logistics, media, technology, and automotive orgs in Italy, Spain, Taiwan, Thailand, Turkey, and the UK. Chain: ANTSWORD/BLUEBEAM web shells → DUSTPAN/DUSTTRAP droppers → BEACON (Cobalt Strike); DUSTTRAP decrypts payloads in memory and was signed with stolen code-signing certificates (one tied to a South Korean gaming company). Oracle DB exfiltration via SQLULDR2/PINEGROVE to OneDrive. (Google Cloud / Mandiant + Google TAG, "APT41 Has Arisen From the DUST")

TTPs by ATT&CK tactic

Reconnaissance

• T1595.002 / T1595.003 — Active scanning: vulnerability scanning (Acunetix, JexBoss) and web-directory brute-forcing (wordlist scanning).
• T1596.005 — Passive scanning of victims via fofa.su.
• T1593.002 / T1594 — Target development via search engines and direct browsing of victim-owned websites.

Resource Development

• T1583.001 / .003 / .006 / .007 — Acquire domains, VPS, web services, and serverless infrastructure (Cloudflare Workers) for staging and C2.
• T1588.002 — Obtain offensive tooling: Mimikatz, pwdump, PowerSploit, credential editors.
• T1588.003 / T1553.002 — Obtain and abuse code-signing certificates (frequently stolen, e.g., DUST campaign) to sign malware.
• T1195.002 — Supply-chain compromise: inject malicious code into legitimately signed software (CCleaner, ASUS, ShadowPad).

Initial Access

• T1190 — Exploit public-facing apps. Rapid weaponization: CVE-2019-19781 (Citrix ADC), CVE-2020-10189 (Zoho ManageEngine), CVE-2021-26855 (Exchange ProxyLogon), CVE-2021-44207 (USAHerds 0-day), CVE-2021-44228 (Log4j).
• T1203 — Exploitation for client execution via malicious documents (CVE-2017-0199, CVE-2017-11882, etc.).
• T1133 — External remote services / third-party VPN access to reach billing/payment systems.
• T1566.001 — Spearphishing attachments, notably compiled-HTML (.chm) files.
• T1684.001 — Impersonation (e.g., posing as video-game-developer employees).

Execution

• T1059.001/.003/.004/.007 — PowerShell, Windows cmd (cmd.exe /c on remote hosts), Unix shell for surveys, and JScript web shells.
• T1218.001 / .007 / .011 — Proxy execution via compiled HTML (.chm), msiexec, and rundll32 loaders.
• T1047 — WMI for remote command execution (WMIEXEC) and persistence.
• T1569.002 — Service execution (svchost/Net) to deploy Cobalt Strike.
• T1197 — BITSAdmin to download/install payloads.

Persistence

• T1547.001 — Registry Run keys / startup-folder modifications for Cobalt Strike.
• T1037 — Linux boot/logon init scripts (hidden scripts in /etc/rc.d/init.d) for rootkit loading.
• T1136.001 — Create local accounts.
• T1543.003 — Create/modify Windows services (e.g., StorSyncSvc; "Windows Defend" service for DUSTPAN).
• T1546.008 — Accessibility-feature (sticky keys) backdoor.
• T1542.003 — MBR bootkits (ROCKBOOT).
• T1053.005 — Create new and hijack legitimate scheduled tasks.
• T1505.003 — Web shells: ANTSWORD, BLUEBEAM, China Chopper, ASPXSpy, JScript shells.

Privilege Escalation

• T1134 — Access-token manipulation via a ConfuserEx-obfuscated BADPOTATO exploit to reach NT AUTHORITY\SYSTEM.
• T1548.002 / .003 — Bypass UAC on Windows; abuse sudo on Linux.

Defense Evasion

• T1070.003/.004/.005 — Clear bash history, delete files/artifacts, clear Windows event logs.
• T1562.006 — Custom ETW-bypass injector to blind Windows logging (Disable/Modify tools/telemetry).
• T1574.001 / .006 — DLL search-order hijacking & side-loading (used for DUSTTRAP); LD_PRELOAD hijacking on Linux.
• T1036.004 / .005 — Masquerade services/tasks as benign tooling; disguise files as AV software; reuse names like USERS/SYSUSER/SYSLOG.
• T1027 / .002 / .013 — Obfuscation: VMProtect/Themida packing, splitting binaries across disk sections, in-memory-decrypted encrypted payloads.
• T1553.002 — Code-signing with stolen certificates (DUSTTRAP).
• T1480.001 — Environmental keying / guardrails: DPAPI encryption; RC5 key derived from volume serial number.

Credential Access

• T1110 — Brute-force local admin passwords.
• T1555 / .003 — Harvest credential stores and browser-saved creds (BrowserGhost).
• T1056.001 — GEARSHIFT keylogger.
• T1003.001/.002/.003 — Dump LSASS (Mimikatz, ProcDump, WCE, hashdump), SAM (reg save, shadow copies), and NTDS (ntdsutil → ntds.dit).
• T1550.002 — Pass-the-Hash using Mimikatz-captured hashes.
• T1556.001 — Modify domain-controller authentication process.

Discovery

• T1087.001/.002 — net enumeration of local and domain admins.
• T1046 / T1135 — Network service scanning (WIDETONE) and net share enumeration.
• T1057 / T1012 / T1082 / T1016 / T1049 / T1033 — Process, registry (RDP ports), systeminfo/net config, ipconfig/MAC, netstat/HIGHNOON RDP-session enumeration, whoami.
• T1018 / T1083 / T1518 / T1613 — Remote-system discovery (MiPing), file/dir discovery, software discovery, domain-trust discovery.

Lateral Movement

• T1210 — Exploitation of remote services.
• T1570 — Lateral tool transfer over remote shares.
• T1021.001 / .002 — RDP (NATBypass to expose RDP ports) and SMB/admin shares (implant transfer + WMI execution).

Collection

• T1005 / T1074.001 — Collect local data, machine info, PII; stage to local CSVs and staging dirs (SAM/SYSTEM hives).
• T1119 — Automated collection via SQLULDR2 and PINEGROVE.
• T1213.003 / .006 — Clone victim Git repositories; bulk-extract Oracle databases.

Command & Control

• T1071.001/.002/.004 — HTTP/HTTPS, FTP, and DNS C2.
• T1573.002 — Encrypted channels (HTTPS / asymmetric crypto).
• T1001.003 — Protocol/service impersonation (LOWKEY.PASSIVE blends into normal web traffic).
• T1568.002 — DGA rotating C2 monthly.
• T1008 / T1102 / T1102.001 — Fallback channels and web-service dead-drop resolvers (GitHub, Pastebin, Microsoft TechNet, Steam community pages).
• T1090 / .004 — Proxying (CLASSFON, Cloudflare CDN) and domain fronting.
• T1571 / T1572 — Non-standard ports and protocol tunneling.
• T1105 / T1104 — Ingress tool transfer (certutil) and multi-stage channels (BEACON downloading second-stage backdoors).

Exfiltration

• T1041 — Exfil over C2 channel (Cloudflare services).
• T1048.003 — Exfil over DNS by encoding data into subdomains.
• T1567.002 — Exfil to cloud storage (OneDrive).
• T1030 — Fixed-size chunking to evade size-based detection.

Impact

• T1486 — Data encrypted for impact: Encryptor RaaS ransomware; abuse of BitLocker and Jetico BestCrypt (primarily in financially motivated operations).

Signature tooling & malware

• Custom / closely-held: ShadowPad (S0596), PlugX (S0013), Winnti for Linux (S0430), Derusbi (S0021), KEYPLUG (S1051), DEADEYE (S1052), DUSTPAN (S1158), DUSTTRAP (S1159), MESSAGETAP (S0443, telco SMS interception), MOPSLED (S1221), LightSpy (S1185, mobile), GEARSHIFT keylogger, LOWKEY, HIGHNOON, WIDETONE, ROCKBOOT (S0112, MBR bootkit), gh0st RAT (S0032), ZxShell (S0412), njRAT (S0385), BLACKCOFFEE (S0069).
• Web shells: ANTSWORD, BLUEBEAM, China Chopper (S0020), ASPXSpy (S0073), custom JScript shells.
• Commodity / public / dual-use: Cobalt Strike BEACON (S0154), Empire (S0363), Mimikatz (S0002), Impacket (S0357 — incl. wmiexec), PowerSploit (S0194), pwdump (S0006), Windows Credential Editor, ProcDump, BrowserGhost, sqlmap (S0225), SQLULDR2 & PINEGROVE (Oracle exfil), NATBypass, CLASSFON, certutil (S0160), BITSAdmin (S0190), and native LOLBins (Net, ipconfig, netstat, ping, dsquery, ftp).

Emulation guidance (Decepticon)

Authorized use only: Execute these techniques solely within the documented engagement scope, rules of engagement, and authorization window. Stay inside approved target ranges and obtain explicit sign-off before any destructive or impact-stage action.

Map APT41's signature behaviors to Decepticon's own capabilities:

• Initial access (T1190, T1505.003): Use Decepticon's recon/scanning and exploitation skills to identify and exploit an in-scope internet-facing app, then drop an in-scope web shell (emulate China Chopper / ANTSWORD behavior). Mirror APT41's defining trait: weaponize a recently disclosed CVE fast against the approved target.
• Execution & ingress (T1105, T1218.011, T1197): From the web shell, emulate the DUSTPAN pattern — use certutil/BITSAdmin (bash/Windows command skills) to pull a stager, then load via rundll32 / DLL side-loading.
• C2 (T1071.001, T1573.002, T1090, T1102.001): Stand up Sliver (c2/sliver skill) as the BEACON analog over HTTPS. Emulate APT41 tradecraft with the defense-evasion kit: domain fronting / CDN proxying, web-service dead-drop resolvers, and DGA-style or non-standard-port profiles where the C2 framework supports it.
• Defense evasion (T1574.001, T1027.002, T1553.002, T1562.006): Use the defense-evasion skill for DLL search-order hijacking / side-loading, packing/obfuscation of the implant, signing test payloads with an authorized cert (emulating stolen-cert behavior), and ETW/event-log tampering — log every change for the blue cell.
• Credential access (T1003.001/.003, T1550.002): Use AD skills to dump LSASS, SAM, and ntdsutil ntds.dit, then perform Pass-the-Hash exactly as APT41 does with Mimikatz/Impacket-equivalent tooling.
• Lateral movement (T1021.001/.002, T1047, T1570): Use the lateral-movement skill to pivot via SMB/admin shares + WMI (wmiexec analog) and RDP, transferring the implant over remote shares.
• Discovery (T1087, T1018, T1082, T1613): Emulate APT41's net/whoami/systeminfo/netstat LOLBin survey via the bash/command skills and AD enumeration; add domain-trust discovery before pivoting.
• Collection & exfil (T1119, T1213.006, T1048.003, T1567.002): If databases are in scope, emulate SQLULDR2-style bulk extraction to staged CSVs, then exfiltrate via DNS-subdomain encoding or to cloud storage using the cloud skills — chunked to fixed sizes (T1030).
• Impact (T1486): Only if the ROE explicitly authorizes destructive emulation — otherwise simulate/flag the ransomware stage rather than executing it.

Recommended emulation chain (DUST campaign analog): web shell → certutil/DUSTPAN-style dropper → side-loaded loader → Sliver BEACON over HTTPS/CDN → credential dump + PtH → SMB/WMI lateral movement → DB collection → DNS/cloud exfil.

Detection & defense

• Web shells (T1505.003): Monitor web roots for new/modified server-executable files; baseline web-server child processes (w3wp/httpd spawning cmd/powershell). Hunt for ANTSWORD/BLUEBEAM/China Chopper signatures and anomalous POST patterns.
• Rapid CVE exploitation (T1190): Aggressively patch internet-facing apps; prioritize the same families APT41 weaponizes (Citrix ADC, Exchange, ManageEngine, Log4j, niche LOB apps like USAHerds). Alert on exploitation attempts within hours of public PoC.
• DLL side-loading & signed malware (T1574.001, T1553.002): Detect legitimate signed binaries loading unsigned/anomalous DLLs from non-standard paths; track certificate-revocation and unexpected signer identities (stolen-cert reuse).
• In-memory / fileless loaders (DUSTTRAP, T1027.013, T1055-style): Deploy EDR with in-memory scanning; alert on encrypted payloads decrypted and executed in memory with minimal disk artifacts.
• Telemetry tampering (T1562.006, T1070.005): Alert on ETW provider disable/patch and Windows event-log clears; forward logs off-host so local clears don't blind the SOC.
• Credential theft (T1003.x): Detect LSASS access by non-system processes, reg save of SAM/SYSTEM, shadow-copy creation, and ntdsutil/NTDS access on DCs. Enable Credential Guard and LSASS protection.
• Lateral movement (T1021.002, T1047, T1550.002): Monitor remote service creation, WMI process creation events (Event ID 4688 + WMI-Activity), admin-share writes, and PtH indicators (NTLM logons from unexpected hosts). Tier/segment admin credentials.
• C2 / exfil (T1071.004, T1048.003, T1090.004, T1567.002): Inspect DNS for high-entropy/long subdomains and abnormal query volume; detect domain fronting and unexpected CDN/Cloudflare-Worker callbacks; monitor cloud-storage uploads (OneDrive) from servers and chunked transfer patterns.
• General: Restrict outbound from servers, enforce app allow-listing to curb LOLBin abuse (certutil/bitsadmin/rundll32), and hunt dead-drop-resolver beaconing to GitHub/Pastebin/Steam.

Sources

• MITRE ATT&CK — APT41 (G0096): https://attack.mitre.org/groups/G0096/
• Mandiant/FireEye — "APT41: A Dual Espionage and Cyber Crime Operation": https://www.mandiant.com/resources/report-apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation
• Mandiant — "APT41 Targeting U.S. State Government Networks" (Campaign C0017): https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments
• Google Cloud / Mandiant + Google TAG — "APT41 Has Arisen From the DUST" (DUSTTRAP, 2024): https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust
• U.S. DOJ — "Seven International Cyber Defendants, Including 'APT41' Actors, Charged…" (Sept 16, 2020): https://www.justice.gov/archives/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer
• TechCrunch — "Justice Department charges five Chinese members of APT41": https://techcrunch.com/2020/09/16/justice-department-charges-apt41-chinese-hackers/
• Kaspersky Securelist — "Operation ShadowHammer" (ASUS supply chain): https://securelist.com/operation-shadowhammer/89992/
• SentinelLabs — "ShadowPad: A Masterpiece of Privately Sold Malware in Chinese Espionage": https://www.sentinelone.com/labs/shadowpad-a-masterpiece-of-privately-sold-malware-in-chinese-espionage/