China-linked APT41 runs state espionage alongside financially motivated operations. The report covers the group's toolset, a PlugX analysis, case studies from aviation, gaming and healthcare, and YARA/Sigma rules.
Key findings
Active since at least 2012, APT41 (BARIUM, Winnti, Double Dragon) targets high-tech, video game, healthcare, telecom and cryptocurrency companies. What sets the group apart from other state-linked actors is that it pursues revenue-generating work such as ransomware and in-game asset theft alongside its espionage tasking.
The report covers supply-chain operations such as ShadowPad and ASUS ShadowHammer, the identified group members, and a toolset ranging from web shells to Cobalt Strike. IoC lists and ready-to-use YARA/Sigma rules are included for detection teams.
Get the report
66 pages, in Turkish. The report opens on this page and is also emailed to you as a PDF.
Other reports
Actor240524, first seen in 2024, targets government bodies and diplomats in Azerbaijan and Israel. The report walks through the infection chain from …
APT29, attributed to Russia's Foreign Intelligence Service (SVR): its operations from SolarWinds to the earthquake-themed campaign against Türkiye, its techniques against cloud …
Campaigns by Iran-linked APT34 against energy, finance, telecom and government organisations in the Middle East; its PowerShell-based backdoors, DNS-based C2 and ready-to-use …