Group-IB has published research on APT41, a group it describes as state-sponsored and active since at least 2007, whose campaigns mix espionage with financial crime. The company says the group gained access to at least thirteen organisations during 2021, across campaigns it spread through the United States, Taiwan, India, Vietnam and China, and it lists public-sector, manufacturing, healthcare, logistics, hospitality, education, media and aviation bodies among the targets.

Two findings stand out. Where earlier reporting described phishing, watering-hole and supply-chain attacks, the campaigns Group-IB examined used SQL injection as the way in — with the publicly available tool SQLmap — and the firm says 43 of 86 websites it looked at were vulnerable to it. The group also used command-and-control servers carrying counterfeit certificates posing as Microsoft, Facebook and Cloudflare; Group-IB says the number of such servers grew to 106 by the end of 2021.

What a time zone tells you, and what it does not

By aligning the group's activity to UTC+8, Group-IB concluded that the operators work from about 9am to 7pm, a pattern that fits several countries including China, Malaysia, Singapore and parts of Australia and Russia. That is an inference from timing, and timing is a hint rather than an identification; the same pattern would fit a group anywhere in that band that chooses to work office hours.

Group-IB says it issued more than 80 early warnings about APT41 in 2021 and that its findings feed its detection products, which is worth holding alongside the research: the firm both studies the group and sells the tools meant to catch it. The count of thirteen victims is the company's, and it says the real number is probably higher — a reminder that in this kind of reporting the confident figures describe what was seen, not what happened.