APT41

Origen🇨🇳 China

Técnicas (MITRE ATT&CK)82

FuenteMITRE ATT&CK

Patrocinio estatal: People's Republic of ChinaCategorías objetivo: Automotive, Business, Services, Cryptocurrency, Education, Energy, Financial, Healthcare, High-Tech, Intergovernmental, Media and Entertainment, Pharmaceuticals, Private sector, Retail, Telecommunications, Travel

Regiones atacadas: China · France · Hong Kong · India · Italy · Japan · Myanmar · Netherlands · Singapore · South Korea +6

También conocido como:AmoebaBARIUMBRONZE ATLASBRONZE EXPORTBlackflyBrass TyphoonDouble DragonEarth BakuG0044G0096GrayflyHOODOOLEADLeopard TyphoonRed KelpieSPIRE CASTLETA415TG-2633WICKED PANDAWICKED SPIDERWicked PandaWinnti

Sobre el grupo

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal100

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 82

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Reconocimiento

Vulnerability Scanning Wordlist Scanning Scan Databases

Preparación de recursos

Tool

Acceso inicial

Exploit Public-Facing Application Compromise Software Supply Chain Spearphishing Attachment

Ejecución

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Unix Shell Exploitation for Client Execution Service Execution

Persistencia

Boot or Logon Initialization Scripts Additional Local or Domain Groups External Remote Services Local Account Windows Service Registry Run Keys / Startup Folder

Escalada de privilegios

Accessibility Features

Acceso a credenciales

LSASS Memory Security Account Manager NTDS Brute Force Credentials from Password Stores Credentials from Web Browsers

Descubrimiento

Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Permission Groups Discovery System Information Discovery File and Directory Discovery Local Account Domain Account Network Share Discovery

Movimiento lateral

Remote Desktop Protocol SMB/Windows Admin Shares Pass the Hash Lateral Tool Transfer

Recolección

Data from Local System Keylogging Code Repositories Archive via Utility

Comando y control

Fallback Channels Web Protocols File Transfer Protocols DNS Proxy Dead Drop Resolver Multi-Stage Channels Ingress Tool Transfer Domain Generation Algorithms

Exfiltración

Data Transfer Size Limits

Impacto

Data Encrypted for Impact Compute Hijacking

defense-impairment

Modify Registry Group Policy Modification Code Signing Network Boundary Bridging Disable or Modify Tools Clear Windows Event Logs

stealth

Rootkit Obfuscated Files or Information Software Packing Masquerade Task or Service Match Legitimate Resource Name or Location Process Injection Clear Command History File Deletion Valid Accounts BITS Jobs Compiled HTML File Rundll32 Environmental Keying Bootkit DLL Dynamic Linker Hijacking Impersonation

Vulnerabilidades explotadas 11

CVEs que este grupo es conocido por explotar, según MITRE ATT&CK. Ordenadas por gravedad real.

CVE-2019-19781CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2021-26855CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2012-0158HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2020-10189CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2019-3396CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2015-1641HIGHEPSS 97%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-8625EPSS 15% MITRE ATT&CK

Infraestructura conocida 6

Indicadores reales (C2, dominios, URLs y hashes) asociados al malware que usa este grupo. Fuente: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash7353d8c8cbfa5381e556c58370e0f3e6bc0e87f80c0d68578a014f9c34ef681fGh0stRATmalwarebazaar

sha256_hash8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8Gh0stRATmalwarebazaar

sha256_hash2f4f3bce4e588901683edc36575b14e829d70007673a001e13ab9d7d18c6fa8fGh0stRATmalwarebazaar

sha256_hash96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fbGh0stRATmalwarebazaar

sha256_hash0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dGh0stRATmalwarebazaar

sha256_hash69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744Gh0stRATmalwarebazaar

Referencias

El grupo APT41 usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →