Chinese Antivirus Firm Was Part of APT41 ‘Supply Chain’ Attack
Summary: The U.S. Justice Department indicted seven Chinese nationals for a decade-long hacking spree against more than 100 high-tech and online gaming companies, alleging they used malware-laced phishing emails and supply chain attacks to steal source code, code signing certificates and customer data. The men are described as part of the group tracked as APT41, Barium, Winnti, Wicked Panda and Wicked Spider, and prosecutors say the group operated out of a Chengdu company called Chengdu 404 that built a searchable 'big data' product named SonarX from previously obtained social media data.
Why it matters: One of the indicted men, Tan DaiLin, was the owner of the Chinese antivirus product Anvisoft, which competing antivirus vendors had whitelisted as safe before several later flagged it for bundling trojans designed to steal online gaming passwords - a reminder that a security tool can itself be the supply chain.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026