APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.1 Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.23
- apt41_mandiant
- FireEye APT41 Aug 2019
- Group IB APT 41 June 2021
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1542.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1599 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1104 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1008 | Fallback Channels | — |
| T1012 | Query Registry | — |
| T1014 | Rootkit | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1030 | Data Transfer Size Limits | — |
| T1033 | System Owner/User Discovery | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1069 | Permission Groups Discovery | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1071.002 | File Transfer Protocols | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1102.001 | Dead Drop Resolver | — |
| T1104 | Multi-Stage Channels | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1133 | External Remote Services | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1197 | BITS Jobs | — |
| T1203 | Exploitation for Client Execution | — |
| T1213.003 | Code Repositories | — |
| T1218.001 | Compiled HTML File | — |
| T1218.011 | Rundll32 | — |
| T1480.001 | Environmental Keying | — |
| T1484.001 | Group Policy Modification | — |
| T1486 | Data Encrypted for Impact | — |
| T1496.001 | Compute Hijacking | — |
| T1542.003 | Bootkit | — |
| T1543.003 | Windows Service | — |
| T1546.008 | Accessibility Features | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.002 | Pass the Hash | — |
| T1553.002 | Code Signing | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1568.002 | Domain Generation Algorithms | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1574.001 | DLL | — |
| T1574.006 | Dynamic Linker Hijacking | — |
| T1588.002 | Tool | — |
| T1595.002 | Vulnerability Scanning | — |
| T1595.003 | Wordlist Scanning | — |
| T1596.005 | Scan Databases | — |
| T1599 | Network Boundary Bridging | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
| T1685.005 | Clear Windows Event Logs | — |
别名
APT41 · BARIUM · Brass Typhoon · Wicked Panda
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。