Kaspersky Uncovers APT41 Cyber Espionage Targeting Southern African Entity

Kaspersky Uncovers APT41 Cyber Espionage Targeting Southern African Entity

APT41 is a state-sponsored threat actor, suspected to operate under the interests of Chinese intelligence. It is known for conducting long-term, stealthy intrusions rather than opportunistic attacks.

Kaspersky links cyber espionage attack in southern Africa to Chinese-speaking APT41

Kaspersky MDR experts say the attack has all the hallmarks of an advanced persistent threat category.

APT41 Hackers Exploiting Atexec and WmiExec Windows Modules for Malware Deployment

Kaspersky MDR analysts recently uncovered a sophisticated targeted attack by the Chinese-speaking cyberespionage group APT41 against government IT services in the African region, marking a notable escalation in the group’s activity on the continent, which had previously seen minimal incidents from this actor. The attackers embedded hardcoded names of internal services, IP addresses, and proxy […] The post APT41 Hackers Exploiting Atexec and WmiE…

China-Linked Hackers Launch Targeted Espionage Campaign on African IT Infrastructure

The China-linked cyber espionage group tracked as APT41 has been attributed to a new campaign targeting government IT services in the African region. "The attackers used hardcoded names of internal services, IP addresses, and proxy servers embedded within their malware," Kaspersky researchers Denis Kulik and Daniil Pogorelov said. "One of the C2s [command-and-control servers] was a captive

Kaspersky: Advanced Persistent Threat (APT41) targets Southern African organisation in espionage attack

Kaspersky: Advanced Persistent Threat (APT41) targets Southern African organisation in espionage attack

SOC files: an APT41 attack on government IT services in Africa

Introduction Some time ago, Kaspersky MDR analysts detected a targeted attack against government IT services in the African region. The attackers used hardcoded names of internal services, IP addresses, and proxy servers embedded within their malware. One of the C2s was a captive SharePoint server within the victim’s infrastructure. During our incident analysis, we were able to determine that the threat actor behind the activity was APT41. This …