APT41 used legitimate executables to perform DLL side-loading of their malware.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT41 deleted files from the system.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|

APT41 used compiled HTML (.chm) files for targeting.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1008|Fallback Channels|

APT41 used the Steam community page as a fallback mechanism for C2.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

APT41 used DNS for C2 communications.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT41 collected MAC addresses from victim machines.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT41 has created user accounts.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|