APT41__2021__Operation_Harvest_A_Deep_Dive_into_a_Long-term_Campaign_McAfee_Blogs.pdf

Operation "Harvest" is a McAfee ATR investigation into a multi-year targeted intrusion that established persistent access to victim networks to steal intellectual property and sensitive intelligence. The adversary compromised web-facing servers to stage tools, deployed PlugX and Winnti variants (including DLL sideloading and custom backdoors), used credential-dumping and privilege-escalation tools for lateral movement, and exfiltrated data via staged web servers, C2 channels and DNS tunneling; the report maps these actions to MITRE ATT&CK, provides IOCs, and notes strong overlap with known APT activity consistent with a Chinese-aligned actor.