Winnti (APT41) 去年被美國 FBI 起訴，但他們並沒有消失，反而使用更新、更難被察覺的方法來突破資安防線。

TeamT5 針對 Winnti (APT41) 的完整研究成果，於台灣駭客年會 HITCON 2021分享。

本次演講簡報現可於官網下載: [連結](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://legacy-uploads.teamt5.org/HITCON_2021_pic_ed282d9a3e.png)
<center>系列網路攻擊鎖定的產業類型</center>



TeamT5 於台灣駭客年會 HITCON 2021 分享 Winnti (APT41)及相關研究

Since Winnti (APT41) was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as:

- Avoiding memory detection through dll hollowing technique and one miscellaneous method.
- Using DPAPI to encrypt the real payload to make forensics more difficult.
- Abusing the certificate to hide the payload in a signed PE file.
- Using Cloudflare Worker to hide the real IP address.
- Using legitimate tools like InstallUtil to execute code and bypass application whitelisting.

In addition to malware that is known to be used by Winnti , we also found some newly developed malware. There are two new pieces of listening port malware, RBRAT and a Stone variant. We also found a shellcode-based backdoor, Natwalk, and the method it used to call the Windows API was also innovative, making the reversing more difficult.

The group is also more careful in their usage of C2. They use DNS tunneling extensively as well as Cloudflare Worker to hide their real C2 IP.

We have observed that Winnti targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021.
The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect.

In this talk we provide more details about the campaigns of Winnti , including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI.

Slides of the talk can be downloaded on the official website : [Link](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://legacy-uploads.teamt5.org/HITCON_2021_pic_ed282d9a3e.png)

<center>Target Industry by Winnti (APT41)</center>
