Rostovcev APT41 2021

APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.

APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.

APT41 queried registry values to determine items such as configured RDP ports and network configurations.

APT41 uses packers such as Themida to obfuscate malicious files.

APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.

APT41 used net group commands to enumerate various Windows user groups and permissions.

APT41 deleted files from the system.

APT41 uses multiple built-in commands such as systeminfo and `net config Workstation` to enumerate victim system basic configuration information.

APT41 used built-in net commands to enumerate local administrator groups.

APT41 used built-in net commands to enumerate domain administrator users.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.

APT41 cloned victim user Git repositories during intrusions.

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.

APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.

APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.

APT41 uses remote shares to move and remotely execute payloads during lateral movemement.

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.

APT41 leverages various tools and frameworks to brute-force directories on web servers.

APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.

APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.