APT41__2019__HELO_Winnti_Attack_or_Scan.pdf

This Lastline analysis examines the Winnti toolkit (a long‑running, sophisticated RAT used by multiple APT actors), documents a July–August 2019 surge in Winnti HELO network activity driven largely by benign scanners, shows how that scan noise buries true infections in telemetry, and provides diagnostic/triage techniques (application‑layer response inspection, HELO generation analysis, and fixes to scanner randomness) and recommendations to reduce false alerts.