APT41 DUST C0040

First seen: January 2023
Last seen: June 2024
Created: 16 September 2024
Last modified: 31 July 2026

APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. APT41 DUST targeted sectors such as shipping, logistics, and media for information gathering purposes. APT41 used previously-observed malware such as DUSTPAN as well as newly observed tools such as DUSTTRAP in APT41 DUST.[1]

Techniques66th pct

Tactics68th pct

Tools & malware71st pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

campaign

APT41 DUST C0040

First seen: January 2023
Last seen: June 2024
Created: 16 September 2024
Last modified: 31 July 2026

Techniques66th pct

Tactics68th pct

Tools & malware71st pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

APT41 DUST MITRE reference C0040

Encrypted/Encoded File T1027.013 ↗

APT41 DUST used encrypted payloads decrypted and executed in memory.2

Stealth1 detection rules

Masquerade Task or Service T1036.004 ↗

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as w3wp.exe or conn.exe.3

Stealth4 detection rules

File Deletion T1070.004 ↗

APT41 DUST deleted various artifacts from victim systems following use.4

Stealth30 detection rules

Web Protocols T1071.001 ↗

APT41 DUST used HTTPS for command and control.5

Command and Control60 detection rules

Local Data Staging T1074.001 ↗

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.6

Collection5 detection rules

Web Service T1102 ↗

APT41 DUST used compromised Google Workspace accounts for command and control.7

Command and Control17 detection rules

APT41 DUST detections C0040

616 distinct rules cover the 23 techniques recorded for this campaign. 413 Sigma · 203 Splunk.

17 covered by at least one rule6 with no coverage616 distinct rules in total

Showing 1-50 of 600+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Detects a highly relevant Antivirus alert that reports a web shell. (...)	Generic	test	antivirus	-	-	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-29	fdf135a2-9241-4f96-a114-bb404948f736
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
Splunk	The following analytic identifiesGetPasswordData API calls in your AWS account. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Guessing Resource Development Compromise Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2022-08-10	2026-05-13	a79b607a-50cc-4704-bb9d-eff280cb78c2
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2022-08-07	2026-05-13	d15e9bd9-ef64-4d84-bc04-f62955a9fee8
Splunk	The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Credential Access Multi-Factor Authentication Request Generation	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	4d2df5e0-1092-4817-88a8-79c7fa054668
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
Splunk	The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel, Splunk	2022-10-03	2026-05-13	55349868-5583-466f-98ab-d3beb321961e
Splunk	The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Guessing Resource Development Compromise Accounts Cloud Accounts	-	medium	Gowthamaraj Rajendran, Bhavin Patel, Splunk	2022-08-07	2026-05-13	a19b354d-0d7f-47f3-8ea6-1a7c36434968
Splunk	The following analytic identifies more than 10 GetPasswordData API calls within a 5-minute window in your AWS account. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Guessing Resource Development Compromise Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-08-10	2026-05-13	4d347c4a-306e-41db-8d10-b46baf71b3e2
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-07	2026-05-13	6153c5ea-ed30-4878-81e6-21ecdb198189
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
Splunk	The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	374832b1-3603-420c-b456-b373e24d34c0
Splunk	The following analytic identifies multiple failed multi-factor authentication (MFA) requests to an AWS Console for a single user. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel	2022-10-03	2026-05-13	1fece617-e614-4329-9e61-3ba228c0f353
Splunk	The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	a520b1fe-cc9e-4f56-b762-18354594c52f
Splunk	The following analytic identifies a single source IP failing to authenticate into the AWS Console with multiple valid users. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-09-26	2026-05-13	0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
Splunk	The following analytic detects high-risk sign-in attempts against Azure Active Directory, identified by Azure Identity Protection. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	1ecff169-26d7-4161-9a7b-2ac4c8e61bea
Splunk	The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk, 0xC0FFEEEE	2022-07-14	2026-05-13	e62c9c2e-bf51-4719-906c-3074618fcc1c
Splunk	The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	482dd42a-acfa-486b-a0bb-d6fcda27318e
Splunk	The following analytic detects potential distributed password spraying attacks in an Azure AD environment. (...)	Hunting	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
Splunk	The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-25	2026-05-13	264ea131-ab1f-41b8-90e0-33ad1a1888ea
Splunk	The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. (...)	Anomaly	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	94481a6a-8f59-4c86-957f-55a71e3612a6
Splunk	The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
Splunk	The following analytic identifies a successful single-factor authentication event against Azure Active Directory. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	a560e7f6-1711-4353-885b-40be53101fcd
Splunk	The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. (...)	Anomaly	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	3d8d3a36-93b8-42d7-8d91-c5f24cec223d
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7

...

APT41 DUST C0040

APT41 DUST C0040

APT41 DUST MITRE reference C0040

APT41 DUST MITRE reference C0040

Standing C0040

Reach

Coverage

APT41 DUST detections C0040