article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

Winnti (aka APT41 , Axiom, Barium , Blackfly) is a cyberespionage group that has been active since at least 2007. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library. ” continues the report.

article thumbnail

Experts attribute WyrmSpy and DragonEgg spyware to the Chinese APT41 group

Security Affairs

The APT41 group, aka Winnti , Axiom, Barium , Blackfly, HOODOO) is a China-linked cyberespionage group that has been active since at least 2007. These commands include instructing the malware to upload log files, photos stored on the device, and acquire device location using the Baidu Location library.” government.

article thumbnail

[SI-LAB] FlawedAmmyy Leveraging Undetected XLM Macros as an Infection Vehicle

Security Affairs

File name: patent-2019-02-20T093A283A05-1.xls In this file, the Workbook stream is interesting as it contains all the information related to that workbook such as the included sheets. The structure of this stream is fully specified in Microsoft Office Excel 97-2007 – Binary File Format Specification. dll library).