APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT41 created a RAR archive of targeted files for exfiltration.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT41 created and modified startup files for persistence.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

APT41 added a registry key in

APT41 used the WMIEXEC utility to execute

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via

PowerSploit.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT41 used compromised credentials to log on to other systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|