TLDR Tech / InfoSec
APT41 Winnti ELF Cloud Credential Harvester: Alibaba Typosquat Infrastructure & 6-Year Lineage
A zero-detection (0/72 VT), stripped x86-64 ELF backdoor attributed to APT41 (Winnti) targets Linux cloud workloads across AWS, GCP, Azure, and Alibaba Cloud, harvesting IAM/managed identity credentials via metadata APIs, AES-256 encrypting them, and exfiltrating over SMTP port 25 to a C2 server at 43[.]99[.]48[.]196 (Alibaba Cloud Singapore) behind three NameSilo-registered typosquat domains (ai[.]qianxing[.]co, ns1[.]a1iyun[.]top, and ai[.]aliyuncs[.]help) that evade Shodan/Censys via selective EHLO token validation. The implant achieves peer-to-peer lateral movement through UDP broadcasts to 255.255.255.255:6006, representing the latest stage in a 6-year Winnti ELF lineage progressing from PWNLNX (2020) through KEYPLUG (2023) to this purpose-built cloud credential harvester. Defenders should alert on outbound port 25 from non-mail workloads, UDP 6006 broadcast traffic, reads of ~/.aws/credentials and equivalent cloud credential paths from non-standard processes, and enforce IMDSv2 on AWS to block unauthenticated metadata API abuse.
Read the full story