Analysts at Kaspersky MDR have documented a targeted intrusion by APT41 — the Chinese-speaking cyberespionage group also tracked as Wicked Panda, Brass Typhoon, Barium, and Winnti — against government IT services in the African region, marking a notable geographic expansion for a threat actor previously least active on the continent. The attack chain demonstrates the group's full operational sophistication: Impacket-based lateral movement, multi-stage DLL sideloading for Cobalt Strike delivery, and a hijacked internal SharePoint server repurposed as command-and-control infrastructure.
Initial Detection: Impacket Footprints on Unmonitored Hosts
Kaspersky MDR's first indicators were alerts flagging WmiExec and Atexec module activity from the Impacket toolkit — specifically, the characteristic process chain svchost.exe > cmd.exe with command output written to numerically named files on administrative network shares. The source was an unmonitored host running Impacket under a service account context. The attackers used these modules to probe C2 reachability both directly over the internet and through an internal proxy, before temporarily suspending operations — a patience-and-probe pattern consistent with professional threat actors conducting deliberate environmental reconnaissance.
Credential Harvesting and Lateral Movement
Returning after a brief lull, APT41 executed process enumeration (tasklist /v) and network connection surveys (netstat -ano) to identify installed security solutions, then used the built-in reg.exe utility to dump SYSTEM and SAM registry hives to C:\Windows\temp\. On hosts covered by Kaspersky's security solution, the dump was blocked; on unmonitored endpoints, the harvest succeeded. Two domain accounts extracted from the hives were then leveraged for lateral movement: one with local administrator rights across all workstations, and a backup solution account carrying domain administrator privileges — providing unrestricted SMB access to administrative shares (C$) across the environment.
DLL Sideloading for Cobalt Strike Delivery
APT41's Cobalt Strike deployment is technically layered. The group distributed encrypted payloads — typically with .txt or .ini extensions — alongside legitimate applications and malicious DLLs that sideload into those applications on launch. When the legitimate binary loads its expected DLL, the malicious substitute executes, decrypts the Cobalt Strike payload from the accompanying file, allocates virtual memory, and spawns a new thread to run the implant. Observed sideloading pairs included:
cookie_exporter.exe(Microsoft Edge) +msedge.dll+Logs.txtTmPfw.exe(Trend Micro) +TmDbg64.dll+TmPfw.iniMpCmdRunq.exe+mpclient.dll+Logs.txt
A notable operational security feature: the malicious DLLs check for installed language packs and abort execution if Japanese, Korean, or Chinese (Mainland or Taiwan) locales are detected — a standard Chinese APT self-exclusion pattern designed to avoid domestic collateral infections.
Persistence was achieved by registering Cobalt Strike as a Windows service under names including server power, WindowsUpdats, and 7-zip Update Agent — all crafted to blend with legitimate system service naming conventions.
Captive SharePoint Server as C2
Perhaps the most distinctive element of the campaign is APT41's repurposing of a compromised internal SharePoint server as command-and-control infrastructure. The attackers installed a web shell named CommandHandler.aspx on the server and distributed C# trojan agents (agents.exe and agentx.exe) via SMB to victim hosts. These agents polled the SharePoint server for commands via hardcoded URLs, executing them through cmd.exe /c and uploading exfiltrated data — browser history, text files, configuration files, and Office documents — back to the server via an upload.ashx web shell. The use of internal trusted infrastructure as C2 is a deliberate evasion of perimeter-based network detection controls that flag outbound connections to external IP addresses.
A New Front for a Veteran Actor
APT41 has historically targeted organizations across telecom, energy, healthcare, education, and IT in at least 42 countries — but Africa had seen minimal activity from the group prior to this incident. The hardcoding of internal service names, IP addresses, and proxy server details directly into the malware indicates the attackers had conducted detailed pre-compromise reconnaissance of the target environment, suggesting this was a deliberate and well-prepared campaign rather than an opportunistic intrusion.