APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.1 Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.23
- apt41_mandiant
- FireEye APT41 Aug 2019
- Group IB APT 41 June 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1542.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1599 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1104 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1008 | Fallback Channels | — |
| T1012 | Query Registry | — |
| T1014 | Rootkit | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1030 | Data Transfer Size Limits | — |
| T1033 | System Owner/User Discovery | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1069 | Permission Groups Discovery | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.002 | File Transfer Protocols | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1102.001 | Dead Drop Resolver | — |
| T1104 | Multi-Stage Channels | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1133 | External Remote Services | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1197 | BITS Jobs | — |
| T1203 | Exploitation for Client Execution | — |
| T1213.003 | Code Repositories | — |
| T1218.001 | Compiled HTML File | — |
| T1218.011 | Rundll32 | — |
| T1480.001 | Environmental Keying | — |
| T1484.001 | Group Policy Modification | — |
| T1486 | Data Encrypted for Impact | — |
| T1496.001 | Compute Hijacking | — |
| T1542.003 | Bootkit | — |
| T1543.003 | Windows Service | — |
| T1546.008 | Accessibility Features | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.002 | Pass the Hash | — |
| T1553.002 | Code Signing | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1568.002 | Domain Generation Algorithms | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1574.001 | DLL | — |
| T1574.006 | Dynamic Linker Hijacking | — |
| T1588.002 | Tool | — |
| T1595.002 | Vulnerability Scanning | — |
| T1595.003 | Wordlist Scanning | — |
| T1596.005 | Scan Databases | — |
| T1599 | Network Boundary Bridging | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
APT41 · BARIUM · Brass Typhoon · Wicked Panda
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.