APT 41: Threat Intelligence Report and Malware Analysis

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanese government website. Their attack chain involves spear-phishing emails, malicious ZIP archives, and a three-module malware system called ToughProgress. This malware uses stealthy techniques like in-memory execution, encryption, and process hollowing to evade detection. The unique aspect of ToughProgress is its use of Google Calendar events for covert data exchange, creating a stealthy communication channel for remote command execution and data exfiltration.

• Libyan Oil Refinery Among Targets in Long-running Likely Espionage CampaignMalware2026-03-20
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace companyMalware2026-09-18
• Beware the SparroWock: The backdoor that bites, the commands that catchMalware2026-09-17