← All threat actors
APT41G0096 ↗
APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.
Motivation
Unknown
Suspected origin
China
Reports / IOCs (VT)
213 reports · 1,151 IOCs
Reported activity
2013 – 2026
Targeted industries
Financial ServicesEnergy & UtilitiesTelecommunicationsRetailEducationPharmaceuticalsTechnologyGovernmentMedia & EntertainmentAutomotiveHealthcareOtherHospitality
Targeted regions
MyanmarKorea, Republic ofNetherlandsThailandChinaTurkeyUnited StatesIndiaItalySingaporeSouth AfricaSwitzerlandFranceHong KongUnited KingdomJapan
Associated malware (30)
ACEHASHASPXSpyBIOPASSBLACKCOFFEECHINACHOPPERCROSSWALKCobalt StrikeColdLockDUSTTRAPDerusbiEASYNIGHTGEARSHIFTGodRATHIGHNOONHIGHNOON.BINJUMPALLKEYPLUGLOWKEYMESSAGETAPMoonBounceMoonWalkPINEGROVEPOISONPLUGPlugXShadowPadSharPyShellTOUGHPROGRESSZXShellcrackshotskip-2.0
CVEs seen in reporting
ATT&CK techniques in reports
- T1190 Exploit Public-Facing Application13
- T1055 Process Injection9
- T1027 Obfuscated Files or Information8
- T1105 Ingress Tool Transfer7
- T1016 System Network Configuration Discovery6
- T1071.001 Web Protocols6
- T1071.004 DNS6
- T1140 Deobfuscate/Decode Files or Information6
- T1543.003 Windows Service6
- T1083 File and Directory Discovery5
- T1005 Data from Local System5
- T1021.002 SMB/Windows Admin Shares5
- T1053.005 Scheduled Task5
- T1059.001 PowerShell5
- T1059.003 Windows Command Shell5
- T1082 System Information Discovery5
- T1112 Modify Registry5
- T1566.001 Spearphishing Attachment5
- T1574.014 AppDomainManager5
- T1021.001 Remote Desktop Protocol4
Also known as
Blackfly, Red Kelpie, Earth Baku, Winnti, BRONZE ATLAS, BRONZE EXPORT, HOODOO, LEAD, Leopard Typhoon, TA415, TG-2633, Double Dragon, G0096, Grayfly, WICKED SPIDER, BARIUM, Amoeba, G0044, WICKED PANDA, SPIRE CASTLE, Brass Typhoon