APT41__2022__Mandiant_Summary-APT41-Targeting-US-State-Governments_03-08-2022.pdf

Mandiant details a persistent APT41 campaign that exploited Internet-facing web applications (notably a USAHerds zero-day and Log4j) to compromise at least six U.S. state government networks; the report describes deserialization-based initial access, deployment of malware families (KEYPLUG, DUSTPAN, DEADEYE, LOWKEY), credential harvesting, Cloudflare-proxied C2 and DNS-based exfiltration, and provides IoCs and detection rules.