Actors/Nation-state / APT/Asia

APT41

G0096APTCN · China

AKA Group 72 · Winnti · WICKED SPIDER · LEAD · WICKED PANDA · Axiom · Brass Typhoon · TG-2633 · Winnti Group · ATK17 · Blackfly · Grayfly · Earth Baku · Suckfly

CrowdStrike: DOUBLE DRAGONMicrosoft: BARIUMMITRE: G0096Secureworks: BRONZE ATLAS

Dual-purpose Chinese threat group conducting espionage and financially motivated operations.

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2012

Also tracked as

5 vendor names · 14 other aliases

Open Rosetta Stone

CrowdStrike

DOUBLE DRAGON

Mandiant

APT41

Microsoft

BARIUM

MITRE

G0096

Secureworks

BRONZE ATLAS

UNATTRIBUTED ALIASESGroup 72WinntiWICKED SPIDERLEADWICKED PANDAAxiomBrass TyphoonTG-2633Winnti GroupATK17BlackflyGrayflyEarth BakuSuckfly

Victimology

Geographic footprint · 25 countries

origin · Chinatargeted countries · 25

OCEANIA · 1

Australia

AMERICAS · 4

Canada · Mexico · United States · Uruguay

ASIA · 13

China · Hong Kong · Indonesia · India · Japan · South Korea · Mongolia · Philippines · Pakistan · Saudi Arabia · Thailand · Türkiye · Taiwan

EUROPE · 6

Germany · France · United Kingdom · Italy · Russia · Sweden

AFRICA · 1

Kenya

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Technology60 actors Telecom72 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Transportation31 actors Hospitality33 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Chemicals20 actors Agriculture & Food18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · EspionageSUP · Supply Chain

MITRE ATT&CK · 73 techniques

Reconnaissance · 1

T1596.005Scan Databases

Resource Development · 3

T1583.001Domains T1583.002DNS Server T1583.003Virtual Private Server

Initial Access · 5

T1189Drive-by Compromise

Execution · 7

T1047Windows Management Instrumentation

Persistence · 4

T1037Boot or Logon Initialization Scripts

Credential Access · 7

T1003OS Credential Dumping

Discovery · 11

T1012Query Registry T1016System Network Configuration Discovery

Lateral Movement · 4

T1021.001Remote Desktop Protocol T1021.002

Collection · 3

T1005Data from Local System T1560Archive Collected Data T1560.001Archive via Utility

Exfiltration · 1

T1030Data Transfer Size Limits

Impact · 1

T1486Data Encrypted for Impact

Command And Control · 9

T1001.002Steganography T1008Fallback Channels T1071.001Web Protocols T1071.002File Transfer Protocols

Defense Impairment · 4

T1112Modify Registry

Stealth · 13

T1014Rootkit T1027

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer73 techniques · layer format 4.5

Related actors

By origin and actor type

T1190

Exploit Public-Facing Application

T1195.002Compromise Software Supply Chain

T1566Phishing

T1566.001Spearphishing Attachment

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.004Unix Shell

T1203Exploitation for Client Execution

T1133

External Remote Services

T1543.003Windows Service

T1547.001Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.002Security Account Manager

T1003.003NTDS

T1110Brute Force

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1018

Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1069Permission Groups Discovery

T1082System Information Discovery

T1083File and Directory Discovery

T1135Network Share Discovery

SMB/Windows Admin Shares

T1550.002Pass the Hash

T1570Lateral Tool Transfer

T1071.004DNS

T1090Proxy

T1102.001Dead Drop Resolver

T1104Multi-Stage Channels

T1105Ingress Tool Transfer

T1553

Subvert Trust Controls

T1599Network Boundary Bridging

T1685Disable or Modify Tools

Obfuscated Files or Information

T1027.002Software Packing

T1036.004Masquerade Task or Service

T1036.005Match Legitimate Resource Name or Location

T1055Process Injection

T1070.004File Deletion

T1078Valid Accounts

T1197BITS Jobs

T1218.001Compiled HTML File

T1218.011Rundll32

T1480.001Environmental Keying

T1684.001Impersonation