APT41__2020__WINNTI_GROUP_Insights_From_the_Past.pdf

This intelligence report details Winnti Group (APT41) activity: analysis of 2014–2016-era malware and drivers (including signed rootkits and DSE bypass tools), discovery of a previously undocumented DNS-tunneling C2 channel implemented via embedded iodine, and targeting of a German chemical company and a South Korean game firm; the report includes numerous IoCs (hashes, domains, IPs), technical analysis of binaries and C2 behavior, and MITRE ATT&CK mappings with recommended defensive actions.