Walking on APT31 infrastructure footprints

This Sekoia intelligence brief analyzes APT31 activity observed in 2021, documenting their use of compromised SOHO routers (Pakedge and others) as Operational Relay Boxes, delivery and use of implants including Cobalt Strike and TinySHell-like ELF backdoors, DNS/registrant heuristics to identify C2 domains, and provides a list of domains, IPs and YARA rules to aid hunting; it contextualizes attribution to Chinese state‑linked actors and notes the shift in infrastructure tactics since mid‑2021.