APT41
- ID
- G0096
- Associated names
- Wicked Panda, Brass Typhoon, BARIUM
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
Techniques used (82)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1005 Data from Local System
- T1008 Fallback Channels
- T1012 Query Registry
- T1014 Rootkit
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1037 Boot or Logon Initialization Scripts
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1069 Permission Groups Discovery
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.004 DNS
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1090 Proxy
- T1098.007 Additional Local or Domain Groups
- T1102.001 Dead Drop Resolver
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1112 Modify Registry
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1197 BITS Jobs
- T1203 Exploitation for Client Execution
- T1213.003 Code Repositories
- T1218.001 Compiled HTML File
- T1218.011 Rundll32
- T1480.001 Environmental Keying
- T1484.001 Group Policy Modification
- T1486 Data Encrypted for Impact
- T1496.001 Compute Hijacking
- T1542.003 Bootkit
- T1543.003 Windows Service
- T1546.008 Accessibility Features
- T1547.001 Registry Run Keys / Startup Folder
- T1550.002 Pass the Hash
- T1553.002 Code Signing
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1568.002 Domain Generation Algorithms
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1574.001 DLL
- T1574.006 Dynamic Linker Hijacking
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1595.003 Wordlist Scanning
- T1596.005 Scan Databases
- T1599 Network Boundary Bridging
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
Software used (32)
- S0002 Mimikatz
- S0006 pwdump
- S0013 PlugX
- S0020 China Chopper
- S0021 Derusbi
- S0032 gh0st RAT
- S0039 Net
- S0069 BLACKCOFFEE
- S0073 ASPXSpy
- S0095 ftp
- S0097 Ping
- S0100 ipconfig
- S0104 netstat
- S0105 dsquery
- S0112 ROCKBOOT
- S0154 Cobalt Strike
- S0160 certutil
- S0190 BITSAdmin
- S0194 PowerSploit
- S0225 sqlmap
- S0357 Impacket
- S0363 Empire
- S0385 njRAT
- S0412 ZxShell
- S0430 Winnti for Linux
- S0443 MESSAGETAP
- S0596 ShadowPad
- S1051 KEYPLUG
- S1158 DUSTPAN
- S1159 DUSTTRAP
- S1185 LightSpy
- S1221 MOPSLED