APT41 Has Arisen From the DUST

This report describes APT41-associated modular malware: DUSTPAN is an in-memory dropper that decrypts and executes embedded or disk-loaded payloads (often BEACON) and persists via Windows services, while DUSTTRAP is a multi-stage plugin framework that uses MachineGUID-keyed AES decryption, trojanizes legitimate DLLs to load plugins in memory, and employs evasion to avoid EDR detection; BEACON payloads use Cloudflare-based C2 channels. The document provides technical TTPs and IOCs intended for detection and response.