APT41__2019__Fireeye_rpt-apt41_08-07-2019.pdf

FireEye's report profiles APT41 as a sophisticated China-linked actor that simultaneously conducts state-backed espionage (targeting healthcare, high-tech, telecoms, media, and government-related targets) and financially motivated operations (notably against the video-game industry). The analysis documents supply-chain compromises (e.g., NetSarang, ASUS ShadowHammer), abuse of legitimate code-signing certificates, use of advanced persistence (bootkits/rootkits), a broad malware toolkit (POISONPLUG, HIGHNOON, CROSSWALK, CRACKSHOT, etc.), extensive IOCs (hashes, domains, email addresses, Google Docs URLs), timelines, and attribution indicators supporting a high-risk, wide-impact adversary.