APT41, also known as Wicked Panda, Barium, and Winnti, exploited Tomcat Apache Manager servers' web shells to facilitate dropper execution and backdoor distribution before leveraging the DUSTTRAP multi-stage plugin framework to conceal malicious activity.
Article Link: Asia, Europe targeted by new APT41 attacks | SC Media