Hoodoo

Hoodoo, also known as APT41, Winnti, Bronze Atlas, and several other aliases, is a threat actor believed to be backed by the Chinese government. This group is renowned for its complex campaigns that target a variety of sectors, with motivations ranging from exfiltrating sensitive data to financial gain. Hoodoo has demonstrated a pattern of using publicly accessible tooling like Cobalt Strike and other penetration testing software available on platforms like Github, instead of building its own unique tools. One such instance was in July 2022 when Hoodoo used GC2 to target an Italian job search website. In October 2022, Google's Threat Analysis Group (TAG) successfully disrupted a campaign run by Hoodoo. Recently, the group targeted a Taiwanese media organization using phishing emails containing links to a password-protected file hosted on Drive. These actions indicate Hoodoo's continued aggressive activity and the broad scope of its targets, which includes entities ranging from job search websites to media organizations. Interestingly, Trend Micro has attributed the intrusion set to a cyber espionage group named Earth Longzhi, which it identifies as a subgroup within Hoodoo. The identification of subgroups within larger threat actors like Hoodoo hints at the complexity and scale of these malicious entities. The cybersecurity community continues to monitor and counteract Hoodoo's activities, highlighting the ongoing nature of this threat.