THREAT ACTOR PROFILE
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path d="M 105.927 161.593 L 105.927 137.814 L 0 137.814 L 0 105.927 L 91.605 2.702 L 158.62 2.702 L 158.62 101.063 L 194.83 101.063 L 194.83 137.814 L 158.62 137.814 L 158.62 161.593 Z M 65.664 100.523 L 105.927 100.523 L 105.927 51.883 L 103.225 51.883 L 65.934 97.821 Z M 240.711 161.593 L 240.711 39.453 L 208.284 41.885 L 206.393 8.107 L 292.594 0 L 292.594 161.593 Z" fill="rgb(37, 101, 195)" height="161.593px" id="JcrtB7ANY" transform="translate(104.449 239.838)" width="292.5940053710938px"/><path d="M 0 58.638 L 29.17 0.099 L 48.782 0.099 L 77.853 58.638 L 62.521 58.638 L 56.647 45.994 L 21.006 45.994 L 14.535 58.638 Z M 24.59 36.238 L 52.964 36.238 L 39.325 9.059 L 38.329 9.059 Z M 83.102 58.638 L 83.102 8.064 L 82.106 0 L 126.209 0 C 130.457 0 133.776 0.564 136.165 1.692 C 138.621 2.821 140.413 4.314 141.541 6.172 C 142.736 7.964 143.499 9.889 143.831 11.946 C 144.163 14.004 144.328 15.962 144.328 17.82 L 144.328 23.694 C 144.328 25.221 144.096 26.946 143.632 28.871 C 143.167 30.729 142.304 32.554 141.043 34.346 C 139.782 36.072 137.957 37.532 135.568 38.727 C 133.178 39.855 130.059 40.419 126.209 40.419 L 116.055 40.419 C 111.873 40.419 107.957 40.32 104.307 40.121 C 100.723 39.922 98.035 39.756 96.243 39.623 L 96.243 58.638 Z M 96.243 30.862 L 123.322 30.862 C 126.309 30.862 128.366 30.132 129.495 28.672 C 130.623 27.212 131.187 25.453 131.187 23.395 L 131.187 17.123 C 131.187 14.999 130.623 13.207 129.495 11.747 C 128.366 10.287 126.342 9.557 123.422 9.557 L 96.243 9.557 Z M 174.509 58.638 L 174.409 9.557 L 148.525 9.557 L 148.525 0 L 213.634 0 L 213.634 9.557 L 187.65 9.557 L 187.65 58.638 Z" fill="rgb(37, 101, 195)" height="58.638000000000005px" id="LjVyBrXub" transform="translate(139.861 112.654)" width="213.63399389648436px"/></svg>)
APT41 is a Chinese state-sponsored group active since 2012 that runs both espionage and financially motivated operations. It has hit healthcare, technology, government and video game companies in more than 14 countries, and its recent tooling leans toward Linux implants and cloud credential theft.
China
Healthcare / IT / Government
First seen
2012
Latest IOC
-
TABLE OF CONTENTS
NAMES AND ALIASES
-
-
-
-
-
-
-
-
-
-
-
GROUP PROFILE
Facts:
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Victims reported in our records and posts:
-
-
-
-
-
-
-
-
-
-
ATTACK LIFECYCLE
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
MALWARE AND TOOLING
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
CVES EXPLOITED
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
IOCS FROM HUNT.IO PLATFORM
Latest IOCs
We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.
NOTABLE CAMPAIGNS
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.