APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud Credentials

APT41 is using a stealthy, statically-linked ELF backdoor against Linux cloud instances to harvest cloud provider credentials (AWS, GCP, Azure, Alibaba); the malware uses SMTP (port 25) as a covert C2 channel, leverages typosquatted domains to blend with legitimate traffic, showed zero VirusTotal detections at analysis, and Breakglass Intelligence provides network-, host-, and cloud-native detection and mitigation recommendations.