APT41__2020__No_Game_over_for_the_Winnti_Group_WeLiveSecurity.pdf

ESET describes the discovery of PipeMon, a modular backdoor attributed to the Winnti Group that targeted MMO video game developers in South Korea and Taiwan; the malware persists via malicious Windows Print Processor DLLs, uses named-pipe inter-module communication and encrypted modules (stored on disk or in registry), is signed with a likely stolen code-signing certificate, and was used in at least one incident involving compromise of a build system with supply-chain implications. The report includes a full technical breakdown, IOCs (hashes, filenames, registry keys, C2 domains/IPs, named pipes), and MITRE ATT&CK mappings.