China-Linked APT41 Espionage - U.S. Policy Nonprofit Hit

China-linked APT41 espionage activity against a U.S. policy-focused nonprofit shows how Beijing-aligned actors pursue long-term access to institutions shaping government decision-making. Symantec reports that attackers first mass-scanned an exposed server on April 5, 2025 using exploits for Log4j, Atlassian OGNL CVE-2022-26134, Apache Struts CVE-2017-9805, and GoAhead CVE-2017-17562, then returned on April 16 to conduct reconnaissance and establish persistence. The intrusion chain relied on DLL sideloading via the VipreAV component vetysafe.exe to load a malicious sbamres.dll, a technique previously linked to Space Pirates and Earth Longzhi, both associated with APT41 activity. The operators created an hourly scheduled task under \Microsoft\Windows\Ras that invoked msbuild.exe as SYSTEM to execute an outbound.xml script, likely injecting code into csc.exe that called out to command-and-control at 38.180.83[.]166. Symantec also observed DCSync-like behavior and use of the Imjpuexc binary, indicating attempts to target domain controllers and harvest directory data for broader lateral movement. Although operations ceased after April 16, the campaign demonstrates persistent interest in U.S. organizations that influence foreign policy toward China, and underscores that think tanks and NGOs remain high-value espionage targets alongside government agencies.