H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DUSTPAN](https://attack.mitre.org/software/S1158) is an in-memory dropper written in C/C++ used by [APT41](https://attack.mitre.org/groups/G0096) since 2021 that decrypts and executes an embedded payload.(Citation: Google Cloud APT41 2024)(Citation: Google Cloud APT41 2022)

Labels

malware

8 recorded

Relationships

uses

from APT41

Group

uses

from APT41 DUST

Campaign

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Embedded Payloads

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Portable Executable Injection

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S1158

Google Cloud APT41 2024

https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust

Google Cloud APT41 2022

https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments