APT 41

☆ pin

MITRE G0096Also known as APT41, RedGolf

Reports

First seen

Apr 25, 2024

Last seen

Jun 4, 2026

Motivation

Espionage

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×2T1071 Application Layer Protocol ×2T1123 Audio Capture ×1T1598.003 Spearphishing Link ×1T1566 Phishing ×1T1598.004 Spearphishing Attachment ×1T1003 OS Credential Dumping ×1T1047 Windows Management Instrumentation ×1T1078 Valid Accounts ×1T1115 Clipboard Data ×1T1557 Man-in-the-Browser ×1T1119 Automated Exfiltration ×1

Indicators

hash_sha1 ×12cve ×11filename ×7domain ×7url ×3ip_v4 ×2email ×1hash_sha256 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26855 (exploited)CVE-2021-26857 (exploited)CVE-2021-26858 (exploited)CVE-2021-27065 (exploited)CVE-2021-43798 (exploited)CVE-2023-2868 (exploited)CVE-2023-3519 (exploited)CVE-2023-7102 (exploited)CVE-2024-3400 (exploited)CVE-2025-0282 (exploited)CVE-2025-61882 (exploited)

Recent reports

High

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

Recorded Future InsiktJun 4, 2026 High

2025 Cloud Threat Hunting and Defense Landscape

Recorded Future InsiktFeb 19, 2026 High

LightSpy Malware Variant Targeting macOS Discovered

Huntress BlogApr 25, 2024

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.