Skip to content

Winnti Group

Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.

ATT&CK ID: G0044
Origin: China
Techniques: 6
Tools: 3

Also tracked as Blackfly

Techniques

Resource Development

Acquire Infrastructure

Stealth

Defense Impairment

Subvert Trust Controls

Discovery

Process Discovery File and Directory Discovery

Command and Control

Ingress Tool Transfer

Software

PipeMon · PlugX · Winnti for Windows

MITRE ATT&CK All threat actors