APT41__2019__report_APT41.pdf

FireEye assesses with high confidence that APT41 is a prolific China-linked threat actor that conducts dual espionage and financially-motivated operations. The report documents targeting across healthcare, high-tech, telecoms, video games and other sectors, detailed case studies (e.g., game industry and healthcare), multiple supply-chain compromises (including NetSarang and the ASUS "ShadowHammer" incident), extensive malware families (POISONPLUG, HIGHNOON, CRACKSHOT, ROCKBOOT, etc.), abuse of legitimate code-signing certificates, operational timelines, TTP mappings, and a long list of IOCs for detection and response.