APT41__2022__VB2022-Tracking-the-entire-iceberg.pdf

**Executive Summary:** This technical report documents analysis of Winnti 4.0 and ShadowPad C2 protocols (TCP/TLS/HTTP(S)/UDP/DNS), describes scanner implementation and internet-wide scanning results that identified over 130 C2 servers (covering ~55–81 servers per family across the studied periods), provides IOCs and attribution to PRC-linked APTs (e.g., APT41/Tonto Team), and notes an incident response triggered by a discovered ShadowPad C2 IP.