APT41 Targets African Government IT Services

APT41, a Chinese state-linked cyberespionage group, launched a sophisticated attack on a Southern African government IT provider, gaining access via an exposed web server and harvesting privileged credentials. They used tools like Cobalt Strike and Impacket, alongside stealthy techniques such as DLL sideloading and internal SharePoint-based C2, to maintain persistence and evade detection. Sensitive data including credentials, emails, and financial details were exfiltrated using custom stealers and post-exploitation tools. The attack highlights critical gaps in endpoint monitoring and privileged account security.