- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Financial crime; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0096 · 82 techniques
- Sources
- 16 sources carry it
- Identifier
- GINC-APT-0001 · apt41
ChinaWhat it is
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Wicked Spider, Wicked Panda
- Mandiant
- APT 41, APT 22
- Microsoft
- Brass Typhoon, Leopard Typhoon
- MITRE ATT&CK
- G0096
- Proofpoint
- TA415
- PwC
- Red Diablo, Red Kelpie
- Secureworks
- TG-2633, TG-2768, TG-3279
- Thales
- ATK122
- Trend Micro
- Earth Baku
- Operations
- Operation ShadowHammer, Operation “ColunmTK”, Operation “CuckooBees”, Operation “ShadowHammer”
- Other names
- BARIUM, BrazenBamboo, Lead, PassCV, SparklingGoblin, Amoeba, Anonymous, Blackfly, Bronze Atlas, Bronze Export, Bronze Olive, Casper, China Cracking Group, Double Dragon, Grayfly, Grey Ares, HOODOO, KAOS, Mana, Pigfish, Sparkling Goblin, SPIRE CASTLE, Starchy Taurus, Vanadinite, Wicked Spider, APT 22, Winnti, Winnti Group, Winnti Umbrella
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Bahrain, Brazil, Canada, Chile, China, Denmark, Finland, France, Georgia, Germany, Hong Kong, India, Indonesia, Italy, Japan, Malaysia, Mexico, Myanmar, Netherlands, Pakistan, Philippines, Poland, Qatar, Russia, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, Thailand, Türkiye, United Arab Emirates, United Kingdom, United States, Vietnam
- Sectors
- Automotive, Business, Construction, Cryptocurrency, Defense, Education, Energy, Financial, Gaming, Government, Healthcare, High-Tech, Hospitality, Intergovernmental, Manufacturing, Media, Media and Entertainment, Oil and gas, Online video game companies, Petrochemical, Pharmaceutical, Pharmaceuticals, Private sector, Retail, Services, Shipping and Logistics, Technology, Telecommunications, Transportation, Travel
Tools
The first 60 of 94 tools and malware families the sources tie to it.
- ASPXSpy
- Archelaus Beta
- BITSAdmin
- BLACKCOFFEE
- Backdoor.Oldrea
- Barlaiy
- Blue Banana
- CRACKSHOT
- CROSSWALK
- Carberp RAT
- China Chopper
- Client Maximus
- ClientMesh
- Cobalt Strike
- Conpee
- CrossRat
- Cyber Eye RAT
- CyberGate
- DUSTPAN
- DUSTTRAP
- Derusbi
- Empire
- Etso
- Excalibur
- FunnySwitch
- GEARSHIFT
- Gh0st RAT
- HIGHNOON
- HOTCHAI
- Impacket
- JUMPALL
- Jynxkit
- KEYPLUG
- Kitkiot
- LATELUNCH
- LIFEBOAT
- LOWKEY
- LightSpy
- MESSAGETAP
- MOPSLED
- Mimikatz
- NJRAT
- Net
- NetCommander
- NetWire RC
- PACMAN
- PHOTO
- POISONPLUG
- POTROAST
- Ping
- PipeMon
- PlugX
- PowerSploit
- ROCKBOOT
- Remote Utilities
- RemoteCMD
- RemotePC
- Runxx
- SAGEHIRE
- SOGU
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de