“Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment,” said the advisory. “However, as persistence occurs early in an intrusion, it is more likely to be observed in all intrusions regardless of the extent of compromise or further actions taken.”

A concerning trend identified in the advisory is APT40’s growing use of compromised devices including small-office or home-office (SOHO) devices as “operational infrastructure and last-hop redirectors” for launching attacks.

These devices, often unpatched and outdated, offer a vulnerable entry point for the group. By compromising SOHO devices, APT40 can mask their activity within legitimate traffic, making detection more challenging for defenders.