Threat intelligence / Campaign

APT41 DUST

[APT41 DUST](https://attack.mitre.org/campaigns/C0040) was conducted by [APT41](https://attack.mitre.org/groups/G0096) from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campaigns/C0040) targeted sectors such as shipping, logistics, and media for information gathering purposes. [APT41](https://attack.mitre.org/groups/G0096) used previously-observed malware such as [DUSTPAN](https://attack.mitre.org/software/S1158) as well as newly observed tools such as [DUSTTRAP](https://attack.mitre.org/software/S1159) in [APT41 DUST](https://attack.mitre.org/campaigns/C0040).(Citation: Google Cloud APT41 2024)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[APT41 DUST](https://attack.mitre.org/campaigns/C0040) was conducted by [APT41](https://attack.mitre.org/groups/G0096) from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campaigns/C0040) targeted sectors such as shipping, logistics, and media for information gathering purposes. [APT41](https://attack.mitre.org/groups/G0096) used previously-observed malware such as [DUSTPAN](https://attack.mitre.org/software/S1158) as well as newly observed tools such as [DUSTTRAP](https://attack.mitre.org/software/S1159) in [APT41 DUST](https://attack.mitre.org/campaigns/C0040).(Citation: Google Cloud APT41 2024)

28 recorded

Relationships

attributed-to

Group

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

Tool

uses

to Cloud Accounts

Technique

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

to Code Signing Certificates

Technique

uses

Technique

uses

to DLL

Technique

uses

Malware

uses

Malware

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Masquerade Task or Service

Technique

uses

to Scan Databases

Technique

uses

to Search Engines

Technique

uses

to Search Victim-Owned Websites

Technique

uses

Technique

uses

to Service Execution

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

C0040

Google Cloud APT41 2024

https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust