Skip to content
←Back to glossaryCyber

APT41 (Double Dragon)

Chinese group mixing espionage for the state with crime on its own account, indicted in the US in September 2020: the textbook case of ambiguous attribution.

Definition

In August 2019, FireEye published a report on a group it called APT41, subtitled Double Dragon. The same operator, with the same tools, did espionage for the Chinese state by day, in healthcare, telecoms and high tech. By night he made money for himself, stealing virtual currency in video games and reselling access. On September 16, 2020, the US Justice Department unsealed charges against five Chinese nationals and two Malaysians, for more than a hundred victims, software vendors and universities among them. For a cyber policy, APT41 is the hard case. The LMA 5564 to 5567 exclusion targets a cyber operation carried out by or on behalf of a state. A group the state tolerates, employs now and then and lets work for itself the rest of the time does not fit that definition cleanly. The same loss can be a state operation or plain theft depending on which night it happened. An insurer that wants to exclude must then prove the state link for that attack, not for the group in general.

Its 6 cross-references, woven across the glossary's 18 categories
APT41 (Double Dragon): Cyber glossary illustration, AlgoPolis
Example

Constructed example: an online game publisher loses the equivalent of 3 million euros in virtual currency, through a backdoor that researchers link to APT41. The insurer considers the state exclusion. The file shows no intelligence interest, only gains resold on marketplaces: the insurer drops the exclusion and settles it as theft.

Read next
CyberAdvanced persistent threat (APT)A sophisticated attacker, often state-sponsored, conducting targeted, discreet and long-lasting intrusions for espionage or sabotage.Read the entry →CyberState cyber proxyA criminal or supposedly independent group acting for a state, with its consent or under its protection, which makes state attribution of an attack, and therefore the cyber war exclusion, deliberately uncertain.Read the entry →CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

APT41, Double Dragon, Wicked Panda, Brass Typhoon, Barium

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.