Chinese Nation-State Hackers APT41 Attack Gambling Sector for Financial Gain

Category	Details
Threat Actors	APT41 (Brass Typhoon, Wicked Panda, Winnti) – Chinese state-sponsored group.
Campaign Overview	Sophisticated cyber campaign targeting the gambling and gaming industry over at least six months. Shifted from espionage to financially motivated attacks.
Target Regions (Victims)	Gambling and gaming industry organizations, with a focus on specific VPN subnets (e.g., 10.20.22).
Methodology	Phantom DLL Hijacking, WMIC abuse for persistence and evasion, spear-phishing suspected for initial access. Adapted tools and tactics based on defenders’ responses, including DCSync attack for password hash theft.
Product Targeted	VPN subnets and administrative/developer accounts within gambling and gaming systems.
Malware Reference	TSVIPSrv.dll, texttable.xsl – used for malicious payloads; GitHub scraping for exfiltration.
Tools Used	Phantom DLL Hijacking, WMIC.exe, PowerShell, DCSync attack, C2 communication tools.
Vulnerabilities Exploited	Abuse of legitimate binaries (LOLBINs), lack of multi-factor authentication, inadequate monitoring of VPN subnets and privileged accounts.
TTPs	Living Off the Land (LOTL) techniques, persistence via WMIC.exe, credential theft using DCSync, DLL Hijacking, adapting to defender actions, targeted spear-phishing campaigns, and long-term network persistence (9 months).
Attribution	APT41 campaign attributed based on overlapping techniques and tools from Operation Crimson Palace, and use of WMIC, DLL Hijacking, and advanced malware.
Recommendations	- Implement MFA for all accounts. - Network segmentation of critical systems. - Least privilege access for all accounts. - Monitor VPN access and LOLBIN activities. - Deploy advanced EDR and track IoCs. - Regular threat simulations and phishing awareness training.
Source	Retail & Hospitality ISAC

Read full article: https://rhisac.org/threat-intelligence/chinese-nation-state-hackers-apt41-attack-gambling-sector-for-financial-gain/

The above summary has been generated by an AI language model