MITRE ATT&CKgroup
G0044 Winnti Group
- Domain
- enterprise
- Aliases
- Blackfly
- Version
- 1.2
- Created
- 2017-05-31
Description
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.
Related
Uses · MITRE ATT&CK (9)
- T1583.001 Domains sub-technique
- S0501 PipeMon software (malware)
- T1553.002 Code Signing sub-technique
- S0013 PlugX software (malware)
- S0141 Winnti for Windows software (malware)
- T1014 Rootkit technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
References
- http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates Symantec Suckfly March 2016
- https://401trg.github.io/pages/burning-umbrella.html 401 TRG Winnti Umbrella May 2018
- https://securelist.com/winnti-more-than-just-a-game/37029/ Kaspersky Winnti April 2013
- https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf Novetta Winnti April 2015
- https://securelist.com/games-are-over/70991/ Kaspersky Winnti June 2015