APT41 Targets African Government IT Services in Espionage Campaign

Executive Summary

In mid-2025, Kaspersky's Managed Detection and Response team identified a cyber espionage campaign targeting a Southern African government IT service provider. The attack was attributed to APT41, a Chinese-speaking advanced persistent threat (APT) group known for its cyber espionage activities. This incident underscores the expanding reach of APT41 into regions previously less affected by such threats.

Attack Overview

The attackers gained access through an internet-exposed web server, employing credential harvesting techniques to obtain two corporate domain accounts: one with local administrator rights and another with domain administrator privileges. These credentials facilitated further system compromises within the organization.

Malware Deployment and Data Exfiltration

APT41 utilized several tools during the attack:

• Pillager: A modified utility designed to export and decrypt data, including saved credentials, internal documents, source code, and communications. The attackers compiled its code into a Dynamic Link Library (DLL) to enhance its stealth.

• Checkout: A stealer capable of collecting saved credentials, browser history, downloaded files, and browser-stored credit card data.

• RawCopy and Mimikatz: Tools used to dump registry files and credentials, facilitating lateral movement within the network.

• Cobalt Strike: Employed for command-and-control (C2) communication on compromised hosts.

Additionally, the attackers leveraged a SharePoint server within the victim's infrastructure as a C2 channel, using custom agents connected via a web shell. This approach likely aimed to blend malicious activity with legitimate traffic, reducing detection risks.

Attribution and Implications

The attack's tactics, techniques, and procedures (TTPs), along with the C2 infrastructure, strongly indicate APT41's involvement. This group's activities have historically been concentrated in Asia, making this campaign in Africa particularly noteworthy. The primary objective was cyber espionage, targeting sensitive data within the organization's network.

Recommendations

To mitigate similar threats, organizations should consider the following measures:

• Comprehensive Security Coverage: Deploy security agents on all workstations to enable timely incident detection and minimize potential damage.

• Privilege Management: Review and control service and user account privileges, avoiding excessive rights assignments, especially for accounts used across multiple hosts within the infrastructure.

• Continuous Monitoring: Implement continuous monitoring of the entire infrastructure to detect and respond to sophisticated attacks promptly.

Conclusion

The APT41 campaign targeting African government IT services highlights the evolving nature of cyber espionage, with APT groups expanding their operations into new regions. Organizations must remain vigilant, adopting proactive security measures to defend against such sophisticated threats.

Source

Kaspersky's analysis of the APT41 attack on a Southern African organization provides detailed insights into the group's tactics and the broader implications for cybersecurity in the region. (kaspersky.com)