APT41 is a China-linked threat group associated with cyberespionage, financial crime, and attacks on organizations across multiple sectors.
Search across headline titles and summaries.
Background for this topic.
APT41 is a Chinese cyber threat group known for combining state-sponsored espionage with financially motivated cybercrime. It targets industries such as healthcare, telecommunications, and technology by exploiting software vulnerabilities and deploying custom malware to maintain long-term access. The group’s operations often involve stealing intellectual property and conducting supply chain compromises.
Security teams should prioritize patching known vulnerabilities exploited by APT41 and monitor for signs of credential theft and lateral movement within networks. Because the group blends legitimate administrative tools with malicious activity, detecting their presence requires careful analysis of unusual access patterns and behavior anomalies. Understanding APT41’s tactics helps defenders anticipate multi-faceted attacks that mix espionage objectives with profit-driven intrusions.
Weekly headline count for the current query.
ThreatFabric found evidence that LighSpy is linked to Android spyware DragonEgg, attributed to the Chinese-sponsored group
Lookout attributed WyrmSpy and DragonEgg to APT41 due to overlapping Android signing certificates
The majority of the attacks spotted relied primarily on SQL injections on targeted domains
Group exploited Log4Shell “within hours,” says Mandiant