How We Secure Contained an APT41 Keylogger Campaign in 72 Hours
In mid-2025, a public-sector organization noticed unusual login activity across its infrastructure and engaged We Secure’s DFIR team for emergency support.
Overview
Our investigation revealed a 30-day undetected intrusion, where the attacker exploited a public web application through SQL injection and deployed a ShadowPad-style DLL loader linked to APT41.
Challenges
- Long-term attacker presence without major alerts.
- Maintaining full business continuity during response.
- Complex persistence using DLL loaders and reverse-proxy tunnels.
Response & Outcome
Working in full alignment with the customer’s Microsoft-based security stack, We Secure conducted the complete incident response process — from investigation to containment and remediation - using the client’s existing tools.
Within 72 hours, the threat was completely eradicated, IOCs documented, and the environment verified as clean, with no operational impact.
.svg)