MITRE ATT&CKgroup

G0096 APT41

Published 2019-09-23 Modified 2026-07-31 Official page ↗
Domain
enterprise, mobile
Aliases
Wicked Panda, Brass Typhoon, BARIUM
Version
4.2
Created
2019-09-23

Description

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Related

Uses · MITRE ATT&CK (114)

  • T1684.001 Impersonation sub-technique
  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • S1221 MOPSLED software (malware)
  • S1185 LightSpy software (malware)
  • T1496.001 Compute Hijacking sub-technique
  • S1158 DUSTPAN software (malware)
  • S1159 DUSTTRAP software (malware)
  • T1098.007 Additional Local or Domain Groups sub-technique
  • S1051 KEYPLUG software (malware)
  • T1595.003 Wordlist Scanning sub-technique
  • T1213.003 Code Repositories sub-technique
  • S0596 ShadowPad software (malware)
  • T1484.001 Group Policy Modification sub-technique
  • T1599 Network Boundary Bridging technique
  • T1595.002 Vulnerability Scanning sub-technique
  • T1596.005 Scan Databases sub-technique
  • T1588.002 Tool sub-technique
  • T1480.001 Environmental Keying sub-technique
  • S0443 MESSAGETAP software (malware)
  • S0430 Winnti for Linux software (malware)
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1568.002 Domain Generation Algorithms sub-technique
Show all 114 ›

Referenced by MITRE ATT&CK · attributed to (2)

References