APT41: A Dual Espionage and Cyber Crime Operation

FireEye's report documents APT41, a prolific China-based threat actor that simultaneously conducts state-sponsored espionage and financially motivated operations since at least 2012. The group targets industries including healthcare, telecommunications, high-tech, education and video games, and is notable for supply-chain compromises, theft of digital certificates, deployment of a large and diverse malware toolkit (including bootkits, backdoors, credential stealers and attempted ransomware), rapid lateral movement across Windows and Linux systems, and operational behaviors suggesting both contractor-style for-profit activity and sophisticated espionage tradecraft.