Not Simon 🐐

2024

• December 12, 2024 – QiAnXin XLab: Glutton: A New Zero-Detection PHP Backdoor from Winnti Targets Cybercrimals
• November 12, 2024 – BlackBerry: LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign
• October 31, 2024 – Sophos: Pacific Rim: Inside the Counter-Offensive—The TTPs Used to Neutralize China-Based Threats
• August 04, 2024 – Trend Micro: A Dive into Earth Baku’s Latest Campaign
• August 01, 2024 – Cisco Talos: APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
• July 18, 2024 – Mandiant: APT41 Has Arisen From the DUST
• July 11, 2024 – Zscaler: MoonWalk: A deep dive into the updated arsenal of APT41 | Part 2
• July 10, 2024 – Zscaler: DodgeBox: A deep dive into the updated arsenal of APT41 | Part 1
• June 10, 2024 – Technical University of Zurich (ETH Zurich): From Vegas to Chengdu: Hacking Contests Bug Bounties, and China’s Offensive Cyber Ecosystem (research paper, PDF)
• May 29, 2024 – Natto Thoughts: APT41’s Reconnaissance Techniques and Toolkit: Nmap and What Else?
• May 22, 2024 – Natto Thoughts: Front Company or Real Business in China’s Cyber Operations
• April 02, 2024 – Trend Micro: Earth Freybug Uses UNAPIMON for Unhooking Critical APIs (APT41 subgroup)
• February 28, 2024 – Natto Thoughts: i-SOON: Kicking off the Year of the Dragon with Good Luck … or Not (more about association of i-SOON to Chengdu 404)

2023

• October 27, 2023 – Natto Thoughts: i-SOON: Another Company in the APT41 Network
• September 22, 2023 – Mandiant: Threat Trends: Unraveling WyrmSpy and DragonEgg Mobile Malware with Lookout
• September 12, 2023 – Symantec: Redfly: Espionage Actors Continue to Target Critical Infrastructure (tenuous link via ShadowPad trojan)
• July 19, 2023 – Lookout: Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41
• May 02, 2023 – Trend Micro: Attack on Security Titans: Earth Longzhi Returns With New Tricks (APT41 subgroup)
• April 01, 2023 – Google Cloud/Threat Analysis Group (TAG): April 2023 Threat Horizons Report (PDF, page 9: HOODOO Uses Public Tooling, Google Workspace to Target Taiwanese Media)
• March 30, 2023 – Recorded Future: With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets (PDF)
• February 28, 2023 – Symantec: Blackfly: Espionage Group Targets Materials Technology

2022

• November 09, 2022 – Trend Micro: Hack the Real Box: APT41’s New Subgroup Earth Longzhi (APT41 subgroup)
• October 18, 2022 – Symantec: Spyder Loader: Malware Seen in Recent Campaign Targeting Organizations in Hong Kong
• September 22, 2022 – U.S. Health and Human Services (HHS): APT41 and Recent Activity (PDF)
• September 14, 2022 – ESET: You never walk alone: The SideWalk backdoor gets a Linux variant
• August 22, 2022 – Mandiant: APT41 (Double Dragon): A Dual Espionage and Cyber Crime Operation (PDF)
• August 18, 2022 – Group-IB:
  • APT41 World Tour 2021 on a tight schedule
  • Inflexible schedule: Group-IB reveals malicious APT41 campaigns involving new tactics and tools
• July 24, 2022 – Intrusion Truth: Chinese APTs: Interlinked networks and side hustles
• July 23, 2022 – Intrusion Truth: The people behind Chengdu 404
• July 22, 2022 – Intrusion Truth: Chengdu 404
• July 21, 2022 – Intrusion Truth: The old school hackers behind APT41
• July 20, 2022 – Intrusion Truth: APT41: A Case Sudy [sic]
• May 02, 2022 – Cybereason:
  • Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation
  • Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive
  • Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
• March 08, 2022 – Mandiant: Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments
• February 15, 2022 – Secureworks: ShadowPad Malware Analysis
• January 20, 2022 – Kaspersky: MoonBounce: the dark side of UEFI firmware

2021

• October 05, 2021 – BlackBerry: Drawing a Dragon: Connecting the Dots to Find APT41
• September 21, 2021 – Recorded Future: China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware, available as PDF (tenuous connection via Winnti malware)
• September 09, 2021 – Symantec: Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware
• August 24, 2021 – ESET: The SideWalk may be as dangerous as the CROSSWALK
• August 24, 2021 – Trend Micro: APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign
  • Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor. (PDF, white paper)
• August 20, 2021 – CISA: Chinese State-Sponsored Cyber Operations: Observed TTPs (generalized Chinese threat activity)
• July 08, 2021 – Recorded Future: Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling (TAG-22 overlaps with Winnti, but is considered Aquatic Panda)
• July 01, 2021 – Avast: Backdoored Client from Mongolian CA MonPass
• June 10, 2021 – Group-IB: Big airline heist
• April 29, 2021 – NTT: The Operations of Winnti group (PDF)
• March 16, 2021 – Dragos: New ICS Threat Activity Group: VANADINITE (Winnti subgroup)
• March 10, 2021 – Intezer: New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor
• March 08, 2021 – Mazaher Kianpour: Socio-Technical Root Cause Analysis of Cyber-enabled Theft of the U.S. Intellectual Property — The Case of APT41 (PDF)
• February 28, 2021 – Recorded Future: China-linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions, majority in PDF
• January 14, 2021 – Positive Technologies: Higaisa or Winnti? APT41 backdoors, old and new

2020

• November 11, 2020 – Microsoft: Hunting for Barium using Azure Sentinel
• October 20, 2020 – CISA: Potential for China Cyber Response to Heightened U.S.–China Tensions (brief mention of APT41)
• September 29, 2020 – Positive Technologies: ShadowPad: new activity from the Winnti group
• September 18, 2020 – Trend Micro: U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks
• September 17, 2020 – Symantec: APT41: Indictments Put Chinese Espionage Group in the Spotlight
• September 16, 2020 – U.S. Department of Justice: Seven International Cyber Defendants, Including “Apt41” Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally (ATTRIBUTION)
  • Indictment: United States of America v. Zhang Haoran, Tan Dailin (PDF)
• September 16, 2020 – FBI FLASH: Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities (PDF)
• June 11, 2020 – Zscaler: The Return of the Higaisa APT (see Positive Technologies link from January 14, 2021)
• June 04, 2020 – Malwarebytes: New LNK attack tied to Higaisa APT discovered (see Positive Technologies link from January 14, 2021)
• May 21, 2020 – ESET: No “Game over” for the Winnti Group
• May 06, 2020 – Trend Micro: Targeted Ransomware Attack Hits Taiwan Organizations
• April 20, 2020 – QuoIntelligence: WINNTI GROUP: Insights From the Past
• April 13, 2020 – Unit 42: APT41 Using New Speculoos Backdoor to Target Organizations Globally
• March 25, 2020 – FireEye: This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
• February ??, 2020 – PwC: Cyber Threats 2019: A Year in Retrospect (PDF, page 10)
• January 31, 2020 – ESET: Winnti Group targeting universities in Hong Kong
• January 31, 2020 – Tagesschau (German news): Deutsches Chemieunternehmen gehackt (German language, archive of dead link. English translated title: “German chemical company hacked”)

2019

• October 31, 2019 – FireEye: MESSAGETAP: Who’s Reading Your Text Messages?
• October 21, 2019 – ESET: Winnti Group's skip-2.0: A Microsoft SQL Server backdoor
• October 15, 2019 – FireEye: LOWKEY: Hunting for the Missing Volume Serial ID
• October 14, 2019 – ESET: Connecting the dots: Exposing the arsenal and methods of the Winnti Group, with whitepaper PDF
• September 14, 2019 – VMware: CB TAU Threat Intelligence Notification: Winnti Malware 4.0
• August 19, 2019 – FireEye: GAME OVER: Detecting and Stopping an APT41 Operation
• August 07, 2019 – FireEye: APT41: A Dual Espionage and Cyber Crime Operation, available as PDF
• July 24, 2019 – Bayerischer Rundfunk (BR): Winnti: Attacking the Heart of the German Industry
• May 29, 2019 – Intezer: HiddenWasp Malware Stings Targeted Linux Systems (link to Winnti malware)
• May 16, 2019 – Lab52: Winnti Group: Geostrategic and TTP (Tactics, Techniques and Procedures)
• May 15, 2019 – Chronicle: Winnti: More than just Windows and Gates
• April 23, 2019 – Kaspersky: Operation ShadowHammer: a high-profile supply chain attack
• March 25, 2019 – Kaspersky: Operation ShadowHammer
• March 11, 2019 – ESET: Gaming industry still in the scope of attackers in Asia

2018

• June 13, 2018 – Microsoft: Microsoft Corporation v. John Does 1-2 (PDF, Case 1:17-cv-01224-TSE-MSN. Proposed default judgment and order for permanent injunction)
• May 03, 2018 – 401 TRG: Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

2017

• September 21, 2017 – ESET: CConsiderations on the CCleaner incident (later attributed to Winnti by ESET on May 20, 2020)
• August 15, 2017 – Kaspersky: ShadowPad in corporate networks (attributed to Winnti by PwC in 2019)
• July 18, 2017 – Clearsky: Recent Winnti Infrastructure and Samples
• April 19, 2017 – Trend Micro: Examining a Possible Member of the Winnti Group
• March 22, 2017 – Trend Micro: Winnti Abuses GitHub for C&C Communications

2016

• October 18, 2016 – BlackBerry: Digitally Signed Malware Targeting Gaming Companies (links PassCV APT to Winnti)

2015

• October 05, 2015 – VSEC: Initial Winnti analysis against Vietnam game company (archive of dead link)
• June 22, 2015 – Kaspersky: Games are over: Winnti is now targeting pharmaceutical companies (links Winnti to Axiom)
• April 07, 2015 – Novetta: Operation SMN – Winnti Update (archive of dead link), Winnti Analysis (PDF, archive of dead link)

2013

• April 15, 2013 – Kaspersky: Winnti returns with PlugX
• April 11, 2013 – Kaspersky:
  • Winnti. More than just a game, available as PDF (ORIGIN OF WINNTI NAME)
  • The Winnti honeypot – luring intruders