APT41__2023__Symantec_Blackfly_Materials_Technology_02-28-2023.pdf

Blackfly (aka APT41/Winnti) is a Chinese-linked espionage group that recently targeted subsidiaries in the materials and composites sector to steal intellectual property; the Symantec report catalogs their 2022–2023 toolset (including a Winnkit rootkit/backdoor, credential-dumpers like Mimikatz, screenshotting and process-hollowing tools, proxy configurators and SQL clients), provides multiple SHA256 IOCs, and outlines mitigation/detection guidance.