APT41 Has Arisen From the DUST | Google Cloud Blog

**Executive Summary:** Mandiant (with Google TAG) attributes a sustained 2023–2024 intrusion campaign to APT41 targeting shipping/logistics, media, technology and automotive organizations across multiple countries; attackers used ANTSWORD/BLUEBEAM web shells to deploy DUSTPAN (to load BEACON) and the multi-stage DUSTTRAP plugin framework for persistence, lateral movement and data theft, leveraging SQLULDR2 and PINEGROVE to extract and exfiltrate Oracle database data (to OneDrive), and abused stolen code-signing certificates — the report provides technical analysis, IOCs and YARA rules for detection and hunting.