Hoodoo

HOODOO, also known as APT41 and numerous other aliases, is a Chinese-origin cyber threat group recognized for its extensive cyber espionage and cybercrime campaigns. The group, which has potential ties to the Chinese government, targets various sectors with complex campaigns aimed at exfiltrating sensitive data and financial gain. HOODOO's operations have been noted for their use of publicly accessible tooling like Cobalt Strike and other "pentest" software, as seen in their implementation of GC2, rather than building their own unique tools. In October 2022, Google's Threat Analysis Group (TAG) successfully disrupted a campaign run by HOODOO. This campaign targeted a Taiwanese media organization through phishing emails containing links to a password-protected file hosted on Drive. Previously, in July 2022, HOODOO used GC2 to target an Italian job search website, demonstrating the group's diverse range of targets. A subgroup within APT41, known as Earth Longzhi, was identified by Trend Micro as being responsible for a specific intrusion set. This highlights the complexity and multi-faceted nature of HOODOO's operations. Despite successful disruption efforts by entities such as Google's TAG, the continuing activities of HOODOO and its subgroups present an ongoing cyber threat.