Winnti Group
- ID
- G0044
- Associated names
- Blackfly
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.[1][2][3] Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.[4]
Techniques used (6)
- T1014 Rootkit
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1553.002 Code Signing
- T1583.001 Domains