Crosswalk Backdoor

At the beginning of 2021, cybersecurity experts uncovered a new backdoor Trojan believed to have ties to the APT41 group. The threatening implant was spotted on networks in Russia and Hong Kong, and security experts suspect that the newly identified Crosswalk Backdoor may originate from China. This backdoor is installed with barely any features, but this seems to be a part of the plan of the attackers. The Crosswalk Backdoor's barebones structure makes it more evasive, and its operators can extend its functionality easily by introducing additional modules at a later stage. The stripped-down version of the Crosswalk Backdoor can receive commands from a remote Command and Control server and collect basic information about the system's configuration.

Allegedly, the recent attacks involving the Crosswalk Backdoor also introduced a previously undocumented piece of malware, which appeared to exhibit behavior typical for other backdoor Trojans.

What is unique about the Crosswalk Backdoor and other malware of APT41 (also known as Winnti) is that they are used against individuals and companies involved in the game and software development business almost exclusively. Previously, the Winnti hackers had managed to compromise the security of renowned software applications like CCleaner.