Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.123 Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.4
- Kaspersky Winnti April 2013
- Kaspersky Winnti June 2015
- Novetta Winnti April 2015
- 401 TRG Winnti Umbrella May 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Winnti Group | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Blackfly | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1014 | Rootkit | — |
| T1057 | Process Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1553.002 | Code Signing | — |
| T1583.001 | Domains | — |
Aliases
Blackfly · Winnti Group
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.