APT41 Exploits Cloud Services with New Zero-Detection ELF Backdoor

APT41, a China-backed threat actor, is using a newly observed zero-detection ELF backdoor to target Linux cloud workloads across AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud. The backdoor uses SMTP (port 25) for covert command-and-control, harvests cloud provider credentials and metadata, and leverages typosquatting to evade detection and attribution, creating a high-risk campaign against cloud environments.