Zero-detection, three-domain hijacking, and a cloud credential harvester. An inside look at the APT41 Winnti ELF backdoor.

A highly sophisticated, virtually undetectable Winnti ELF backdoor linked to APT41 is targeting cloud environments by abusing lookalike Chinese tech domains and stealthy C2 channels to steal cloud credentials and enable broad lateral movement across compromised infrastructures.