MalwarePublished 21 Jul 2025Updated 20 Aug 2025

SOC files: an APT41 attack on government IT services in Africa

Source AlienVault OTX General

Description

Chinese cyberespionage group APT41 conducted a targeted attack against government IT services in Africa. The attackers used various tools including Impacket, Cobalt Strike, and custom malware for lateral movement, privilege escalation, and data exfiltration. They leveraged DLL sideloading techniques and a compromised SharePoint server as a command and control center. The attack involved credential harvesting, use of web shells, and custom stealers to collect sensitive data. Notable TTPs included using hardcoded internal service names and proxy servers in malware, and exploiting a captive SharePoint server for C2 communication. The incident highlights the importance of comprehensive infrastructure monitoring and proper access controls.

Impact

For European organizations, especially government entities and critical infrastructure providers, this threat presents a significant risk due to the advanced tactics employed by APT41. Although the campaign is currently reported in Africa, the techniques used—such as DLL sideloading, SharePoint server compromise, and credential harvesting—are applicable to similar IT environments globally. European government agencies often use SharePoint and similar collaboration platforms, which could be targeted for covert C2 operations. The compromise of credentials and lateral movement capabilities could lead to unauthorized access to sensitive government data, disruption of services, and potential espionage activities. Data exfiltration could result in loss of confidential information, impacting national security and diplomatic relations. Additionally, the use of web shells and custom malware increases the difficulty of detection and remediation, potentially allowing attackers to maintain persistence for extended periods. The medium severity rating reflects the complexity and targeted nature of the attack, but the potential impact on confidentiality and integrity of government systems is substantial. European organizations must be vigilant against similar campaigns, as APT41 and comparable groups have a history of expanding their targeting scope.

Defensive guidance

To mitigate this threat, European government IT services should implement the following specific measures: 1) Harden SharePoint and other collaboration platforms by applying the latest security patches, restricting administrative access, and monitoring for unusual activity or unauthorized file uploads that could indicate web shell deployment. 2) Deploy advanced endpoint detection and response (EDR) solutions capable of identifying DLL sideloading attempts and anomalous process behaviors associated with Impacket and Cobalt Strike usage. 3) Enforce strict credential hygiene by implementing multi-factor authentication (MFA) across all critical systems, regularly auditing privileged accounts, and using credential vaulting solutions to reduce the risk of credential theft. 4) Monitor network traffic for signs of proxy usage and unusual outbound connections, particularly to internal service names or IP addresses hardcoded in malware samples. 5) Conduct regular threat hunting exercises focused on detecting lateral movement techniques and the presence of web shells. 6) Employ network segmentation to limit lateral movement opportunities and isolate sensitive government services. 7) Establish comprehensive logging and centralized monitoring to detect early indicators of compromise, including unusual SharePoint access patterns and authentication anomalies. 8) Provide targeted cybersecurity training to IT staff on recognizing and responding to advanced persistent threat behaviors, emphasizing the risks associated with DLL sideloading and custom malware.

Indicators of compromise

Domains 12

azure.online
msn-microsoft.org
s3-azure.com
upload-microsoft.com
ap-northeast-1.s3-azure.com
chyedweeyaxkavyccenwjvqrsgvyj0o1y.oast.fun
github.githubassets.net
ns1.s3-azure.com
ns2.s3-azure.com
toun.callback.red

URLs 3

http://chyedweeyaxkavyccenwjvqrsgvyj0o1y.oast.fun/aaa
http://github.githubassets.net/okaqbfk867hmx2tvqxhc8zyq9fy694gf/hta
http://toun.callback.red/aaa

IP addresses 1

38.175.195.13

Hashes 25

100b463eff8295ba617d3ad6df5325c6
125b257520d16d759b112399c3cd1466
15097a32b515d10ad6d793d2d820f2a8
27f506b198e7f5530c649b6e4860c958
2cd15977b72d5d74fadedfde2ce8934f
2f9d2d8c4f2c50cc4d2e156b9985e7ca
3021c9bca4ef3aa672461ecadc4718e6
3af014db9be1a04e8b312b55d4479f69
4708a2ae3a5f008c87e68ed04a081f18
740d6eb97329944d82317849f9bbd633

Community reviews

Loading reviews…