- Category
- State · Attributed to a state or working for one.
- Origin
- China(medium confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0044 · 6 techniques
- Sources
- 2 sources carry it
- Identifier
- GINC-APT-1158 · winnti-group
ChinaWhat it is
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Wicked Panda, Winnti Group, Wicked Panda
- Microsoft
- Leopard Typhoon
- MITRE ATT&CK
- G0044
- Other names
- Blackfly
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
Targets
- Countries
- Belarus, Brazil, China, Germany, India, Indonesia, Japan, Peru, Philippines, Russia, South Korea, Taiwan, Thailand, United States, Vietnam
- Sectors
- Aviation, Defense, Education, Financial, Government, Healthcare, Online video game companies, Pharmaceutical, Technology, Telecommunications
Tools
The tools and malware families the sources tie to it.
- PipeMon
- PlugX
- Winnti for Windows
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th