APT41__2019__Winnti_More_than_just_Windows_and_Gates.pdf

Chronicle provides a technical analysis of a Linux variant of the Winnti malware family, documenting two components (a backdoor and an Azazel-derived userland rootkit), embedded configuration decoding, multiple hardcoded C2 addresses, and a passive inbound listener feature that allows operators to initiate connections to infected hosts; the report includes file hashes, decoded config examples, YARA rules, and numerous IoCs tied to distinct campaign designators.