C0017: C0017
C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]
Analyst context for executives and security teams
C0017 matters because it shows how a campaign can turn exposed web applications into repeated enterprise compromise, even after remediation. MITRE describes APT41 compromising at least six U.S. state government networks between May 2021 and February 2022 by exploiting vulnerable Internet-facing web applications, adapting to public and zero-day vulnerabilities, and exfiltrating PII. For leaders, the practical issue is not only patching; it is whether remediation is verified, credentials are assumed exposed, and monitoring can prove the attacker did not return.
Executive priority
Prioritize this as an Internet-facing application, identity, and data-protection risk. The supplied description highlights vulnerable public web apps, re-compromise after remediation, credential tooling such as Mimikatz, Active Directory discovery via dsquery, command-and-control, staging, and exfiltration behaviors. Executives should ask whether the organization can identify exposed applications quickly, patch or mitigate urgent vulnerabilities, validate eradication after compromise, preserve evidence for PII-related reporting, and demonstrate to auditors that remediation was effective rather than merely completed.
Technical view
SOC and IR teams should treat C0017 as a relationship-driven campaign profile: initial access through vulnerable public web applications, followed by discovery, credential access, execution, persistence, C2, staging, and exfiltration behaviors. ATT&CK provides no official detection text for the campaign, so validation should be built from the linked techniques and software: Mimikatz, dsquery, Cobalt Strike, KEYPLUG, DEADEYE, Ping, Windows command shell, JavaScript execution, scheduled tasks, masqueraded services/resources, protocol or service impersonation, web-protocol C2, proxy use, local data staging, and exfiltration over C2 or unencrypted non-C2 protocols.
Likely telemetry
- Internet-facing web application, web server, reverse proxy, and WAF logs around exploitation attempts and suspicious post-exploitation requests
- Vulnerability management and asset inventory records for externally reachable web applications, including remediation timestamps
- Endpoint process, command-line, module/load, file creation, and service/task creation telemetry, especially on systems hosting public applications
- Windows security and registry-related telemetry relevant to SAM access and credential dumping behaviors
- Active Directory query and administrative tool usage telemetry, including dsquery where present
Detection direction
- Because MITRE provides no campaign-level detection, map detections to the linked techniques and validate them against local telemetry availability.
- Correlate public web application alerts with later endpoint execution, command shell activity, scheduled task creation, suspicious services, credential access, AD discovery, and outbound C2-like traffic.
- Tune for living-off-the-land and dual-use ambiguity: Ping, dsquery, command shells, scheduled tasks, and Cobalt Strike-like activity can be legitimate in some contexts, so detections should include host role, user context, timing, parent process, and destination reputation where available.
- Look specifically for remediation failure indicators: repeated suspicious activity from the same exposed application, new persistence after patching, or credential use after a host was rebuilt or cleaned.
- Validate coverage for stealth and evasion relationships, including packed/obfuscated files, masqueraded task or service names, legitimate-looking file locations, and web traffic that blends with normal HTTP/S.
Mitigation priorities
- Start with complete inventory and risk ranking of Internet-facing web applications; ensure urgent public vulnerabilities are patched, mitigated, or isolated based on exposure and business criticality.
- After suspected exploitation, do not treat patching as eradication. Validate host integrity, remove persistence, rotate affected credentials, review AD exposure, and monitor for re-compromise.
- Harden identity paths reachable from web application servers: restrict privileges, limit credential material on servers, monitor credential dumping indicators, and review service accounts used by exposed applications.
- Reduce post-compromise movement and exfiltration options through network segmentation, least privilege, controlled egress, and monitoring of outbound web and unencrypted protocols.
- Maintain evidence needed for incident response and compliance: vulnerability status, remediation actions, log retention, PII data location, access records, and exfiltration assessment artifacts.
Analyst notes and limits
The most important decision point is remediation assurance. The official description states that victims were re-compromised in at least two cases following remediation efforts, making this campaign especially relevant to IR closure criteria, executive reporting, and audit evidence. The relationship set also makes identity telemetry material: Mimikatz, SAM credential access, dsquery, and discovery behaviors suggest defenders should assume a web-app incident may become an enterprise credential and directory exposure problem.
ATT&CK does not provide official detection guidance, campaign platforms, or campaign tactics for C0017 in the supplied fields. Technique and software relationships provide defensive context, but they should not be treated as a complete kill chain for every intrusion. The campaign goals are stated as unknown, although PII exfiltration was observed. Local application inventory, vulnerability exposure, logging coverage, data locations, and incident evidence are required to determine relevance and priority.
C0017
C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1680 | Local Storage Discovery | |
| Enterprise | T1027.002 | Software Packing Sub-technique | |
| Enterprise | T1033 | System Owner/User Discovery | |
| Enterprise | T1036.004 | Masquerade Task or Service Sub-technique | |
| Enterprise | T1016 | System Network Configuration Discovery | |
| Enterprise | T1053.005 | Scheduled Task Sub-technique | During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.CitationMandiant APT41 |
| Enterprise | T1190 | Exploit Public-Facing Application | |
| Enterprise | T1505.003 | Web Shell Sub-technique | |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | |
| Enterprise | T1003.002 | Security Account Manager Sub-technique | |
| Enterprise | T1027 | Obfuscated Files or Information | |
| Enterprise | T1041 | Exfiltration Over C2 Channel | |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol Sub-technique | |
| Enterprise | T1074.001 | Local Data Staging Sub-technique | |
| Enterprise | T1071.001 | Web Protocols Sub-technique | |
| Enterprise | T1005 | Data from Local System | |
| Enterprise | T1102.001 | Dead Drop Resolver Sub-technique | |
| Enterprise | T1059.007 | JavaScript Sub-technique | |
| Enterprise | T1574 | Hijack Execution Flow | |
| Enterprise | T1090 | Proxy | |
| Enterprise | T1036.005 | Match Legitimate Resource Name or Location Sub-technique | |
| Enterprise | T1059.003 | Windows Command Shell Sub-technique | |
| Enterprise | T1001.003 | Protocol or Service Impersonation Sub-technique | |
| Enterprise | T1134 | Access Token Manipulation | |
| Enterprise | T1567 | Exfiltration Over Web Service | |
| Enterprise | T1560.003 | Archive via Custom Method Sub-technique | |
| Enterprise | T1588.002 | Tool Sub-technique | |
| Enterprise | T1105 | Ingress Tool Transfer | |
| Enterprise | T1102 | Web Service |
Groups, software, and campaigns
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S1051: KEYPLUG
S1052: DEADEYE
S0105: dsquery
dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. [1] It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.
S0002: Mimikatz
S0097: Ping
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 71597dfcce1c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Mandiant APT41
Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.
Open source URL -
[2]
mitre-attack C0017Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.