Target Industry
These sectors are typically targeted by APT41:
- Government and defence sectors
- Education
- Finance
- Healthcare
- Retail
- Technology
- Telecommunications
- Video gaming.
Overview
Kaspersky has attributed a targeted intrusion campaign to APT41, a known Chinese state-linked cyber espionage group, marking a significant escalation in their activity across Africa. The attackers compromised internal government IT systems by leveraging DLL sideloading, Cobalt Strike, and custom .NET agents, while establishing persistent access through hijacked SharePoint infrastructure.
The campaign demonstrates APT41’s continued evolution and adaptability, incorporating both legitimate tools and custom malware to maintain long-term access and exfiltrate sensitive documents.
Impact
The attackers successfully exfiltrated sensitive files, including internal documents and credentials, from government IT infrastructure. Given the nature of the victim, this compromises national security, exposes confidential data, and increases the risk of follow-on campaigns or strategic manipulation. The use of hijacked internal SharePoint servers for command-and-control (C2) heightens the threat of undetected espionage.
Exploitation
There is no evidence that this campaign leveraged public common vulnerability exposures (CVEs). However, APT41 relied on Impacket modules (WmiExec and Atexec), DLL sideloading techniques, and web shells (e.g. Neo-reGeorg) to establish access, move laterally, and execute remote commands.
Containment, Mitigations & Remediations
To mitigate threats from APT41 it is highly recommended to:
- Implement least privilege access
- Use multi-factor authentication (MFA) across all critical systems
- Regularly audit and remove unused or dormant accounts
- Use endpoint detection and response (EDR) and extended detection and response (XDR) tools to monitor for suspicious activity in real time
- Apply security patches for operating systems, applications, and firmware as soon as they are released
- Monitor for zero-day vulnerabilities and apply mitigations where patches are unavailable.
Threat Landscape
This campaign represents a notable expansion of Chinese cyber espionage into Africa. The hijacking of internal SharePoint infrastructure for C2, use of renamed Microsoft binaries, and multilayered credential theft techniques reflect a high degree of operational maturity.
APT41’s ability to blend into the environment and modify attack tooling mid-operation highlights the growing need for visibility into lateral movement and host-based persistence methods.
Threat Group
APT41, also known as Wicked Panda, Brass Typhoon, BARIUM, and Group G0096, is believed to be linked to the Chinese government, with operations dating back to at least 2012. The group is highly sophisticated and is known for carrying out both state-sponsored espionage and financially motivated cybercrime. Several members have been indicted by the FBI for offences including unauthorised access, identity theft, money laundering, and wire fraud. They are alleged to have operated under a front company called Chengdu 404 Network Technology.
Further Information
