APT41__2019__ESET_Winnti.pdf

This ESET technical report analyzes the Winnti Group’s toolkit and methods, exposing a novel PortReuse passive network backdoor that injects into processes listening on common ports, updated ShadowPad variants, VMProtected droppers, and custom packing/crypto techniques used in supply-chain compromises; it includes modular architecture details, exploitation and persistence techniques, C2 retrieval mechanisms (public-hosted documents/profiles), extensive IoCs (hashes, IPs, signatures), and evidence of active abuse (Censys-identified infected hosts and Monero miners).