APT41, a Chinese state-sponsored hacking group, has targeted the gambling and gaming industry in a sophisticated cyberattack. The attack spanned several months and saw hackers collect sensitive data from their victims’ infrastructure, including network configurations and passwords.

APT41, also known as Brass Typhoon, Earth Baku, Wicked Panda, and Winnti, infiltrated a company for nearly nine months. The attackers continuously evolved their toolset in response to the security team’s defense tactics, adjusting their strategies to bypass detection. This campaign was noted for its stealth, leveraging various custom tools to avoid security software, steal critical information, and maintain covert remote access.

Security Joes, an Israeli cybersecurity firm that helped respond to the breach, disclosed that the attack, dubbed Operation Crimson Palace by Sophos, was financially motivated and likely state-sponsored. The hackers focused on gaining persistent access to the network and harvesting password hashes through a DCSync attack.

Although the exact entry point of the attack remains unclear, experts suspect spear-phishing emails were used, given the lack of vulnerabilities in the relevant web applications. Once inside, the attackers conducted extensive reconnaissance, escalated their privileges, and deployed additional malware. Notable techniques included Phantom DLL Hijacking and the use of legitimate system tools like wmic.exe to trigger malicious activities.

During the attack, a malicious DLL file is downloaded via the SMB protocol. This file connected to a command-and-control (C2) server, which, if unavailable, was found by scraping GitHub for C2 information. By parsing GitHub, the malware generated an encoded IP address to contact a new server.

The attackers momentarily paused operations after being detected but returned with obfuscated JavaScript and modified XSL files to evade further detection. The malicious code targeted specific IP addresses within a VPN subnet, ensuring only relevant devices were impacted.

APT41’s ability to adapt and launch attacks with precision reinforces its reputation as a group of highly skilled cybercriminals, who target critical industries for both espionage and financial gain. In 2022, the hacking group managed to steal 20 million USD in COVID financial aid.