Skip to content

APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

ATT&CK ID: G0096
Origin: China
Weather family: Typhoon
Techniques: 66
Tools: 32

Also tracked as Wicked Panda · Brass Typhoon · BARIUM

Vulnerabilities it has exploited

Techniques

Reconnaissance

Active Scanning Search Open Technical Databases

Resource Development

Obtain Capabilities

Initial Access

Valid Accounts External Remote Services Exploit Public-Facing Application Supply Chain Compromise Phishing

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter BITS Jobs Exploitation for Client Execution System Services Hijack Execution Flow

Persistence

Boot or Logon Initialization Scripts Scheduled Task/Job Valid Accounts Account Manipulation Modify Registry External Remote Services Create Account BITS Jobs Pre-OS Boot Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Initialization Scripts Scheduled Task/Job Process Injection Valid Accounts Account Manipulation Domain or Tenant Policy Modification Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Stealth

Rootkit Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts BITS Jobs System Binary Proxy Execution Execution Guardrails Pre-OS Boot Hijack Execution Flow Social Engineering

Defense Impairment

Modify Registry Domain or Tenant Policy Modification Subvert Trust Controls Network Boundary Bridging Disable or Modify Tools

Credential Access

OS Credential Dumping Input Capture Brute Force Credentials from Password Stores

Discovery

Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Permission Groups Discovery System Information Discovery File and Directory Discovery Account Discovery Network Share Discovery

Lateral Movement

Remote Services Use Alternate Authentication Material Lateral Tool Transfer

Collection

Data from Local System Input Capture Data from Information Repositories Archive Collected Data

Command and Control

Fallback Channels Application Layer Protocol Proxy Web Service Multi-Stage Channels Ingress Tool Transfer Dynamic Resolution

Exfiltration

Data Transfer Size Limits

Impact

Data Encrypted for Impact Resource Hijacking

Software

ASPXSpy · BITSAdmin · BLACKCOFFEE · China Chopper · Cobalt Strike · DUSTPAN · DUSTTRAP · Derusbi · Empire · Impacket · KEYPLUG · LightSpy · MESSAGETAP · MOPSLED · Mimikatz · Net · Ping · PlugX · PowerSploit · ROCKBOOT · ShadowPad · Winnti for Linux · ZxShell · certutil · dsquery · ftp · gh0st RAT · ipconfig · netstat · njRAT · pwdump · sqlmap

MITRE ATT&CK All threat actors