APT41 used a keylogger called GEARSHIFT on a target system.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.002|Domain Generation Algorithms|

APT41 has used DGAs to change their C2 servers monthly.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

APT41 used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.(Citation: FireEye APT41 Aug 2019)
|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT41 attempted to masquerade their files as popular anti-virus software.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|