The SOC files: Rumble in the jungle or APT41’s new target in Africa

Kaspersky MDR investigated a targeted APT41 campaign against government IT services in Africa in which attackers used compromised hosts and internal services (including a captive SharePoint server) as C2, leveraged Impacket modules (WmiExec/Atexec) for lateral movement, performed registry dumps and credential harvesting (Mimikatz, RawCopy), deployed Cobalt Strike via DLL sideloading and custom C# agents for command execution and exfiltration, and used stealers (Pillager, Checkout) to collect sensitive data; the report provides IOCs (file hashes, domains, IPs), detection rules (YARA, Sigma), attribution to APT41 with high confidence, and mitigations emphasizing full endpoint coverage and least-privilege account management.