APT41 leveraged PowerShell to deploy malware families in victims’ environments.(Citation: FireEye APT41 Aug 2019)(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

APT41 leveraged sticky keys to establish persistence.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT41 has used hashdump,

Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT41 used RDP for lateral movement.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

APT41 performed password brute-force attacks on the local admin account.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,Windows|T1542.003|Bootkit|

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|