A previously undocumented Linux backdoor attributed to China-linked threat group APT41 (Winnti) has been uncovered, targeting cloud workloads across AWS, GCP, Azure, and Alibaba Cloud.
The ELF-based implant, currently showing zero detections on VirusTotal, transforms Linux servers into stealthy credential theft nodes using a novel SMTP-based command-and-control (C2) mechanism.
The discovery indicates a new phase in APT41’s Linux and cloud-targeted operations, marking a meaningful evolution in their tradecraft.
Unlike typical HTTPS or DNS callbacks, the backdoor communicates over SMTP port 25, a port often left unrestricted in cloud networks hosting mail services.
The malware exchanges encoded payloads within SMTP message bodies, receiving commands hidden in SMTP reply codes. Many detection systems overlook such traffic, granting APT41 a reliable, low-friction covert channel in enterprise environments.
Security researcher @TuringAlex first surfaced the sample, while @Xlab_qax linked it to the long-running Winnti malware family.
The implant also includes a selective handshake validation mechanism. The C2 server, located at 43[.]99[.]48[.]196 and hosted on Alibaba Cloud (Singapore), requires a valid token in the initial SMTP “EHLO” command.
Scanners or crawlers like Shodan and Censys that fail the check see only a benign server banner effectively rendering the system invisible to automated reconnaissance.
APT41’s Linux implant aggressively harvests credentials and metadata from major cloud providers:
All stolen data is encrypted with a hardcoded AES-256 key before being staged for exfiltration.
Researchers mapped three typosquat domains impersonating Alibaba Cloud and Qianxin services ai[.]qianxing[.]co, ns1[.]a1iyun[.]top, and ai[.]aliyuncs[.]help.
All were registered via NameSilo within a 24-hour window (January 20–21, 2026) and hosted on Alibaba Cloud infrastructure in Singapore. This bulk-registration pattern aligns with APT41’s historical opsec methodology observed in prior campaigns.
The “a1iyun” domain notably replaces the letter l with the numeral , a signature homoglyph technique common in Winnti infrastructure.
Beyond credential theft, the implant sends periodic UDP broadcast beacons to 255.255.255.255:6006 within the local subnet.
This peer-to-peer coordination technique allows infected hosts to propagate tasks laterally without additional C2 traffic, further complicating detection.
This backdoor traces back to a six-year lineage of Winnti’s Linux tooling:
This progression underscores APT41 strategic shift from simple implants to cloud-native credential harvesters engineered for persistence and stealth in multi-cloud environments.
As cloud-native security matures, APT41’s refinement of zero-detection ELF malware highlights the widening attack surface and the urgency for cloud defenders to deeply inspect non-web traffic such as SMTP for hidden persistence channels.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…