APT41 Delivers 'Undetectable' Backdoor to Steal Cloud Credentials

APT41, the China-backed threat group, has deployed a zero-detection ELF backdoor targeting Linux-based cloud workloads across AWS, GCP, Azure, and Alibaba Cloud. The malware uses SMTP port 25 as a covert C2 channel, making it invisible to conventional scanning tools like Shodan and Censys, and carries zero detections on VirusTotal. It immediately probes cloud instance metadata endpoints to harvest temporary credentials. The campaign also uses typosquatted domains mimicking Alibaba Cloud and the Qianxin cybersecurity brand, registered in bulk through NameSilo with WHOIS privacy. Defenders are advised to monitor outbound SMTP from non-mail workloads, audit cloud credential file reads, enable AWS CloudTrail and Google Cloud Audit Logs, and implement IMDSv2 to mitigate credential theft.