APT41

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains a

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BI

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email No

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate s

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help syst

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather th

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the e

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

ASPXSpy is a Web shell. It has been modified by Threat Group-3390

BITSAdmin is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/

BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye

China Chopper is a Web Shell hosted on Web servers to prov

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

DUSTPAN is an in-memory dropper written in C/C++ used by APT41 sin

DUSTTRAP is a multi-stage plugin framework associated with APT41 o

Derusbi is malware used by multiple Chinese APT groups.(Citation: ThreatConnect An

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

KEYPLUG is a modular backdoor written in C++, with Windows and Linux variants, that has been used by [APT41

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macO

MESSAGETAP is a data mining malware family deployed by APT41 into

MOPSLED is a shellcode-based modular backdoor that has been used by China-nexus cyber espionage actors incl

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in t

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

PowerSploit is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.

ROCKBOOT is a Bootkit that has been used by an unidentifie

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang sof

Winnti for Linux is a trojan, seen since at least 2015, designed specifically for targeting Linux systems.

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly

certutil is a command-line utility that can be used to obtain certificate authority information and configu

dsquery is a command-line utility that can be used to query Active Directory for information from a system

ftp is a utility commonly available with operating systems to transfer information over the File Transfer P

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netstat is an operating system utility that displays active TCP connections, listening ports, and network s

APT41 DUST was conducted by APT41 from 2023 to July 2024 against

C0017 was an APT41 campaign conducted between May 2021 and Februa