THE THREAT LANDSCAPE
MOVED OVERNIGHT.

Since early January, Mandiant's threat intelligence teams have tracked a resurgence in APT41 activity targeting SWIFT-connected financial institutions across North America and Southeast Asia. The group, historically known for dual espionage and financially motivated operations, appears to have shifted its primary toolset — moving away from its signature POISONPLUG implant toward a new loader family internally designated as SILKTHREAD.

Initial access vectors in confirmed intrusions share a common pattern: a weaponized PDF delivered via spear-phishing, exploiting CVE-2025-4891 in Adobe Acrobat Reader. Once inside, the actor demonstrates exceptional operational security — living off the land with WMI subscriptions and scheduled tasks, avoiding the kind of noisy lateral movement that triggers modern EDR solutions.