APT41 Turns Linux Cloud Servers Into Credential Theft Targets With New Winnti Backdoor

Cybersecuritynews •Tushar Subhra Dutta • April 14, 2026

APT41 is once again pushing its Linux capabilities forward, this time by quietly turning cloud servers into powerful credential theft platforms. The group’s latest Winnti-family backdoor is a zero‑detection ELF implant designed specifically for Linux workloads running on AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud, with a clear focus on stealing cloud credentials at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT41 Exploits Cloud Services with New Zero-Detection ELF Backdoor APT41, a China-backed threat group, has been identified using a new zero-detection ELF backdoor targeting Linux cloud workloads across major platforms including AWS, Google Cloud Platform, Microsoft Azure, and Alibaba Cloud. The backdoor operates via SMTP port 25 for command-and-control communication, making it difficult to detect with conventional tools. This malware harvests cloud provider credentials and metadata, posing a significant risk to organizations with broad permissions. The backdoor has zero detections on VirusTotal, indicating its stealthy nature. APT41 has also employed typosquatting techniques, registering domains that mimic legitimate services to obscure its activities. The campaign represents a notable evolution in APT41's operational tactics, focusing on cloud environments rather than traditional endpoints. The group has a history of state-sponsored espionage and cybercrime, with previous indictments failing to deter its operations. 6 sources 77

Extracted Entities

APT41 Turns Linux Cloud Servers Into Credential Theft Targets With New Winnti Backdoor

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Companies (3)

Platforms (1)

Tools (1)