C0040: APT41 DUST
APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. APT41 DUST targeted sectors such as shipping, logistics, and media for information gathering purposes. APT41 used previously-observed malware such as DUSTPAN as well as newly observed tools such as DUSTTRAP in APT41 DUST.[1]
Security context for executives and security teams
C0040: APT41 DUST describes [APT41 DUST](https://attack.mitre.org/campaigns/C0040) was conducted by [APT41](https://attack.mitre.org/groups/G0096) from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campaigns/C0040) targeted sectors such as shipping, logistics, and media for information gathering purposes. [APT41](https://attack.mitre.org/groups/G0096) used previously-observed malware such as [DUSTPAN](https://attack.mitre.org/software/S1158) as well as newly observed tools such ...
Executive priority
C0040: APT41 DUST is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0040: APT41 DUST by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0040: APT41 DUST appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
APT41 DUST
APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. APT41 DUST targeted sectors such as shipping, logistics, and media for information gathering purposes. APT41 used previously-observed malware such as DUSTPAN as well as newly observed tools such as DUSTTRAP in APT41 DUST.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1102 | Web Service | APT41 DUST used compromised Google Workspace accounts for command and control.[1] |
| Enterprise | T1213.006 | DatabasesSub-technique | APT41 DUST collected data from victim Oracle databases using SQLULDR2.[1] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.[1] |
| Enterprise | T1070.004 | File DeletionSub-technique | APT41 DUST deleted various artifacts from victim systems following use.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.[1] |
| Enterprise | T1505.003 | Web ShellSub-technique | APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.[1] |
| Enterprise | T1588.003 | Code Signing CertificatesSub-technique | APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.[1] |
| Enterprise | T1586.003 | Cloud AccountsSub-technique | APT41 DUST used compromised Google Workspace accounts for command and control.[1] |
| Enterprise | T1119 | Automated Collection | APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.[1] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | APT41 DUST used encrypted payloads decrypted and executed in memory.[1] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.[1] |
| Enterprise | T1567.002 | Exfiltration to Cloud StorageSub-technique | APT41 DUST exfiltrated collected information to OneDrive.[1] |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.[1] |
| Enterprise | T1596.005 | Scan DatabasesSub-technique | APT41 DUST used internet scan data for target development.[1] |
| Enterprise | T1574.001 | DLLSub-technique | APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.[1] APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.[1] |
| Enterprise | T1569.002 | Service ExecutionSub-technique | APT41 DUST used Windows services to execute DUSTPAN.[1] |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | APT41 DUST used HTTPS for command and control.[1] |
| Enterprise | T1594 | Search Victim-Owned Websites | APT41 DUST involved access of external victim websites for target development.[1] |
| Enterprise | T1583.007 | ServerlessSub-technique | APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.[1] |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | APT41 DUST used HTTPS for command and control.[1] |
| Enterprise | T1553.002 | Code SigningSub-technique | APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.[1] |
| Enterprise | T1593.002 | Search EnginesSub-technique | APT41 DUST involved use of search engines to research victim servers.[1] |
Groups, software, and campaigns
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
S0160: certutil
S1159: DUSTTRAP
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S1158: DUSTPAN
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | ef8fe48abfba… | ||
| 19.1 | 1.0 | Older bundle | 0312428620ad… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Google Cloud APT41 2024
Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
Open source URL - [2]mitre-attackC0040Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.