Antlion — APT Profile
Antlion is an espionage actor that Symantec's Threat Hunter Team attributes to Chinese state sponsorship, documented in February 2022 across at least three Taiwanese organisations — two in finance, one in manufacturing — in a campaign running roughly eighteen months. Dwell time was the striking element: Symantec measured close to 250 days inside the financial victim, whose intrusion ran from December 2020 through August 2021, and about 175 days at the manufacturer. The group's signature implant is xPack, a bespoke .NET loader that decrypts and launches AES-protected payloads, issues system commands, drops follow-on tooling and stages files for theft; it sits alongside the C++ loaders EHAGBPSL, JpgRun and CheckID, a custom keylogger, an SMB session enumerator and a Mimikatz-derived golden ticket utility. Symantec could not establish the entry point but saw MSSQL abused to run operating-system commands, pointing at an exposed application or service, and noted the actor's earlier use of malicious email; CVE-2019-1458 was used for privilege escalation and AnyDesk for remote access. Registry credential dumping underpinned lateral movement, while WinRAR archives and PowerShell BitsTransfer uploads moved data out, with the operators showing particular interest in business contacts, investment records and smart card reader software. Symantec assesses that Antlion has been conducting espionage operations since at least 2011, though no public reporting has placed it in a fresh intrusion since the 2021 activity.
Tools & malware
Vendor research
Countries linked to this actor
Read the full analysis on IntelFusions