Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations.
In short
MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. The US Department of Justice charged five Chinese nationals in 2019 and 2020 and said the hacking reached more than 100 victims.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT41 | MITRE ATT&CK; 2020 US indictment; FBI notice[1, 8, 10] |
| Wicked Panda | MITRE ATT&CK Associated Groups; US 2020 indictment[1, 10] |
| Brass Typhoon | MITRE ATT&CK Associated Groups[1] |
| BARIUM | MITRE ATT&CK Associated Groups; FBI notice "APT 41 Group"[1, 8] |
| Winnti | Named by MITRE as a group APT41 partly overlaps with; listed as a label in the 2020 US indictment[1, 10] |
| Wicked Spider | 2020 US indictment[10] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK page created 23 September 2019, modified 31 July 2026
Assessed by researchers as a Chinese state-sponsored espionage group that also conducts financially motivated operations, active since at least 2012.[1]
US Department of Justice, grand jury (D.C.) 15 August 2019 (FBI notice)
Indicted Zhang Haoran and Tan Dailin for alleged hacking of high technology and video game firms, with a conspiracy alleged from about May 2011.[8, 9]
US Department of Justice, grand jury (D.C.) 11 August 2020
Indicted Jiang Lizhi, Qian Chuan and Fu Qiang as officers of Chengdu 404 Network Technology. It says their hacking has in some cases been tracked under the labels APT41, Barium, Winnti, Wicked Panda and Wicked Spider.[8, 10]
US Department of Justice, grand jury (D.C.) 18 August 2020 (filed in open court)
Charged two Malaysian businessmen in connection with the video game scheme.[11]
US Department of Justice 16 September 2020
Announced three unsealed indictments, two arrests and action with private partners against the group's infrastructure. The US Attorney for D.C. said the indictments do not blatantly allege state sponsorship, but that some targets, such as pro-democracy groups, suggest the defendants also acted as proxies. The Deputy Attorney General said the PRC government has made a deliberate choice to allow its citizens to commit intrusions.[12]
FBI undated notice
Lists the five Chinese nationals on a wanted notice as "part of a Chinese hacking group known as APT 41 and BARIUM".[8]
Sources differ on state links. MITRE describes APT41 as state-sponsored, as researchers have assessed it. The 2020 US indictment quotes defendant Jiang as saying his link to the PRC Ministry of State Security gave him protection. At the 16 September 2020 press conference the US Attorney said the indictments do not blatantly allege state sponsorship, and drew a conclusion about proxies from the choice of targets. Sources also differ on the start date: MITRE says active since at least 2012, the 2019 indictment alleges a conspiracy from at least May 2011, and the 2020 indictment says Jiang and Qian have worked together since at least 2012. MITRE gives the DUST campaign as January 2023 to June 2024 in its dates and as 2023 to July 2024 in its text.
Each entry is attributed to the group by the sources cited.
The 2019 US indictment alleges Zhang Haoran and Tan Dailin conspired from no later than about May 2011.[9]
The 2020 US indictment alleges Qian worked with other hackers on malicious tools while Winnti malware was relatively new.[10]
The 2020 US indictment alleges Jiang, Qian and Fu have worked as officers of Chengdu 404 Network Technology since about May 2014.[10]
The 2019 US indictment alleges a separate scheme against video game companies since at least this date.[9]
MITRE says ShadowPad was first identified in a mid-July 2017 supply chain compromise and was originally thought to be used only by APT41.[4]
The 2020 indictment alleges PlugX was installed on university computers in Hong Kong.[10]
An indictment of two Malaysian businessmen is filed in open court.[11]
DOJ and FBI announce three unsealed indictments, two arrests and action against infrastructure with private partners.[12]
MITRE says the group compromised at least six US state government networks.[2]
MITRE describes a campaign against shipping, logistics and media organizations in Europe, Asia and the Middle East.[3]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 15 August 2019 | US Department of Justice (D.C. grand jury) | IndictmentZhang Haoran and Tan Dailin charged with computer intrusion, wire fraud, aggravated identity theft and money laundering.[8, 9] |
| 11 August 2020 | US Department of Justice (D.C. grand jury) | IndictmentJiang Lizhi, Qian Chuan and Fu Qiang charged with racketeering, money laundering, fraud, identity theft and access device fraud, per the FBI notice.[8, 10] |
| 18 August 2020 | US Department of Justice (D.C. grand jury) | IndictmentTwo Malaysian nationals charged with racketeering and racketeering conspiracy in the video game scheme; filed in open court.[11] |
| 16 September 2020 | US Department of Justice and FBI | Unsealing and arrestsThree indictments unsealed. The Deputy Attorney General said the two Malaysian defendants were arrested and faced extradition.[12] |
| 16 September 2020 | US Department of Justice and FBI | Infrastructure disruptionDOJ said it worked with seven private sector partners to disrupt the group's servers, malware and domains, took control of or disabled accounts under court orders and terms of service violations, and issued a public safety announcement on its tactics.[12] |
| undated | FBI | Wanted noticeFBI Washington Field Office asks for information on five named Chinese nationals.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
MITRE lists spearphishing emails with compiled HTML (.chm) attachments; the 2020 indictment alleges spear phishing.[1, 10]
Exploit Public-Facing Application T1190
MITRE lists exploitation of CVE-2019-19781 and CVE-2020-10189 against Citrix and Zoho systems.[1]
Supply Chain Compromise: Compromise Software Supply Chain T1195.002
MITRE lists access to production environments to inject malicious code; both indictments allege supply chain attacks.[1, 9, 10]
Valid Accounts T1078
MITRE lists use of compromised credentials to log on to other systems.[1]
ShadowPad Backdoor
MITRE says it is a modular backdoor first identified in a mid-July 2017 supply chain compromise and since used by several Chinese groups.[1, 4]
PlugX Malware
The 2020 indictment names PlugX among the malware used and alleges its installation on Hong Kong university computers; MITRE lists it.[1, 10]
Winnti for Linux Trojan
MITRE says it is a Linux trojan seen since at least 2015 and shared by more than one actor.[1, 5]
KEYPLUG Backdoor
MITRE says it is a modular backdoor with Windows and Linux variants, used by APT41 since at least June 2021.[1, 6]
DUSTTRAP Plugin framework
MITRE says it is a multi-stage plugin framework with multiple components, used in the DUST campaign.[1, 3, 7]
DUSTPAN Malware
MITRE says APT41 has used it in various campaigns since at least 2021.[1, 3]
China Chopper Web shell
MITRE lists it as software used by APT41.[1]
Cobalt Strike Post-exploitation framework
MITRE lists it as software used by APT41.[1]
Mimikatz Credential dumping tool
MITRE lists use of Mimikatz for credential dumping and pass the hash.[1]
Derusbi Malware
MITRE lists it as software used by APT41.[1]
MESSAGETAP Malware
MITRE lists it as software used by APT41.[1]
Also linked in our threat library:
Patch exposed applications quickly, put a web application firewall in front of them and restrict outbound traffic from public-facing servers.
Counters T1190
Run a patch management process, scan for known flaws and review code or updates from third parties before you roll them out.
Counters T1195.002
Require MFA on all account types and disable legacy authentication, which does not support MFA.
Counters T1078
Audit and monitor email attachments and file transfers, and use tools that scan and remove malicious attachments.
Counters T1566.001
Limit which accounts can change web directories, and look for new files in web directories followed by the web server starting command shells.
Counters T1505.003
Keep offline backups, test restores, and enable cloud-delivered protection and Attack Surface Reduction rules.
Counters T1486
See which of your internet-facing applications and servers are exposed, so flaws of the kind listed above can be fixed first.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
Watch for leaked or sold company credentials, since MITRE lists compromised credentials among the group's entry methods.
Track ransomware activity relevant to your sector, since the FBI notice alleges ransomware demands.
MITRE describes it as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. The US charged five Chinese nationals in 2019 and 2020 over activity it links to this label.
MITRE lists a campaign from January 2023 to June 2024. None of the government sources opened for this page states whether the group is active now.
MITRE lists healthcare, telecoms, technology, finance, education, retail and video games. The US indictments add hotels, universities and software firms, in Asia, Europe, North America, Australia and South America.
The 2020 US indictment alleges spear phishing, exploit code against vulnerable software and supply chain attacks. MITRE adds flaws in public-facing applications and compromised credentials.
Sources differ. MITRE calls the group state-sponsored. At the 16 September 2020 press conference the US Attorney said the indictments do not blatantly allege state sponsorship. The 2020 indictment quotes one defendant claiming ties to the Ministry of State Security.
Patch internet-facing systems, turn on multi-factor authentication, review how you receive third-party software updates and look for web shells.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.