APT41 DUST

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. APT41 DUST targeted sectors such as shipping, logistics, and media for information gathering purposes. APT41 used previously-observed malware such as DUSTPAN as well as newly observed tools such as DUSTTRAP in APT41 DUST.(Citation: Google Cloud APT41 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

APT41

Attribution confidence

Not established

First documented activity

2023-01-31

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2023-01-31

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-06-30

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1102 · Web Service

  Command And Control — APT41 DUST used compromised Google Workspace accounts for command and control.(Citation: Google Cloud APT41 2024)

• T1213.006 · Databases

  Collection — APT41 DUST collected data from victim Oracle databases using SQLULDR2.(Citation: Google Cloud APT41 2024)

• T1543.003 · Windows Service

  Persistence, Privilege Escalation — APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.(Citation: Google Cloud APT41 2024)

• T1070.004 · File Deletion

  Stealth — APT41 DUST deleted various artifacts from victim systems following use.(Citation: Google Cloud APT41 2024)

• T1105 · Ingress Tool Transfer

  Command And Control — APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.(Citation: Google Cloud APT41 2024)

• T1505.003 · Web Shell

  Persistence — APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.(Citation: Google Cloud APT41 2024)

• T1593.002 · Search Engines

  Reconnaissance — APT41 DUST involved use of search engines to research victim servers.(Citation: Google Cloud APT41 2024)

• T1588.003 · Code Signing Certificates

  Resource Development — APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.(Citation: Google Cloud APT41 2024)

• T1586.003 · Cloud Accounts

  Resource Development — APT41 DUST used compromised Google Workspace accounts for command and control.(Citation: Google Cloud APT41 2024)

• T1119 · Automated Collection

  Collection — APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.(Citation: Google Cloud APT41 2024)

• T1027.013 · Encrypted/Encoded File

  Stealth — APT41 DUST used encrypted payloads decrypted and executed in memory.(Citation: Google Cloud APT41 2024)

• T1074.001 · Local Data Staging

  Collection — APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.(Citation: Google Cloud APT41 2024)

• T1567.002 · Exfiltration to Cloud Storage

  Exfiltration — APT41 DUST exfiltrated collected information to OneDrive.(Citation: Google Cloud APT41 2024)

• T1036.004 · Masquerade Task or Service

  Stealth — APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.(Citation: Google Cloud APT41 2024)

• T1596.005 · Scan Databases

  Reconnaissance — APT41 DUST used internet scan data for target development.(Citation: Google Cloud APT41 2024)

• T1574.001 · DLL

  Stealth, Execution — APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.(Citation: Google Cloud APT41 2024) APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.(Citation: Google Cloud APT41 2024)

• T1569.002 · Service Execution

  Execution — APT41 DUST used Windows services to execute DUSTPAN.(Citation: Google Cloud APT41 2024)

• T1560.001 · Archive via Utility

  Collection — APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.(Citation: Google Cloud APT41 2024)

• T1071.001 · Web Protocols

  Command And Control — APT41 DUST used HTTPS for command and control.(Citation: Google Cloud APT41 2024)

• T1594 · Search Victim-Owned Websites

  Reconnaissance — APT41 DUST involved access of external victim websites for target development.(Citation: Google Cloud APT41 2024)

• T1583.007 · Serverless

  Resource Development — APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.(Citation: Google Cloud APT41 2024)

• T1573.002 · Asymmetric Cryptography

  Command And Control — APT41 DUST used HTTPS for command and control.(Citation: Google Cloud APT41 2024)

• T1553.002 · Code Signing

  Defense Impairment — APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.(Citation: Google Cloud APT41 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0040

  Official MITRE ATT&CK campaign record C0040. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.