APT41 World Tour 2021 on a tight schedule

Group-IB provides a consolidated analysis of APT41 activity during 2021, describing multiple global intrusion campaigns that leveraged SQL injection, public-facing application exploits (including ProxyLogon), and Cobalt Strike beacons. The report maps observed TTPs to MITRE ATT&CK, lists commands and artifacts used (PowerShell reverse shells, certutil Base64 payload assembly, scheduled tasks, service creation, credential dumping via ntds.dit/LSASS/Mimikatz), supplies IOCs and Cobalt Strike configs, notes attacker infrastructure patterns (CloudFlare-protected C2, custom SSL certs), and offers hunting guidance and defensive recommendations.