Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT41 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT41

  • G0096
  • TA415
  • Blackfly
  • Grayfly
  • LEAD
  • BARIUM
  • WICKED SPIDER
  • WICKED PANDA

state sponsor · People's Republic of ChinaMITRE G0044 ↗

APT41 — ATT&CK roseAP

attack rose · 6 techniques across 5 tactics

What changed

ledger · newest first
  1. —todaynew CVE11 new CVEs: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, CVE-2019-19781, CVE-2019-19871 +5 more

Analyst brief

misp-galaxy + mitre-attack

APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.

Observed targets (as stated by the sources)

16 countries · 16 sectors
ChinaFranceHong KongIndiaItalyJapanMyanmarNetherlandsSingaporeSouth KoreaSouth AfricaSwitzerlandThailandTürkiyeUnited KingdomUnited StatesAssessed origin: China

assessed origin · Chinaobserved targets · 16

countries · 16

  • China
  • France
  • Hong Kong
  • India
  • Italy
  • Japan
  • Myanmar
  • Netherlands
  • Singapore
  • South Korea
  • South Africa
  • Switzerland
  • Thailand
  • Türkiye
  • United Kingdom
  • United States

sectors · 16

  • Automotive
  • Business
  • Services
  • Cryptocurrency
  • Education
  • Energy
  • Financial
  • Healthcare
  • High-Tech
  • Intergovernmental
  • Media and Entertainment
  • Pharmaceuticals
  • Private sector
  • Retail
  • Telecommunications
  • Travel

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

6 techniques · 5 of 15 tactics

  1. Resource development

    1 technique

  2. Stealth

    1 technique

  3. Defense impairment

    1 technique

  4. Discovery

    2 techniques

  5. Command and control

    1 technique

select a technique

Arsenal

3 malware · 14 tools
Malware
Malware · 3ATT&CK
PipeMonS0501 ↗
Winnti for WindowsS0141 ↗
PlugXS0013 ↗
Tools
Tools · 14ATT&CK
BITSAdminS0190 ↗
ImpacketS0357 ↗
netstatS0104 ↗
PowerSploitS0194 ↗
PingS0097 ↗
NetS0039 ↗
ipconfigS0100 ↗
sqlmapS0225 ↗
MimikatzS0002 ↗
certutilS0160 ↗
EmpireS0363 ↗
pwdumpS0006 ↗
dsqueryS0105 ↗
ftpS0095 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT41 is cited as exploiting

none on KEV
  1. CVE-2017-118822026-10-17
    1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2019-33962026-10-17
    1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2015-16412026-10-17
    1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2017-01992026-10-17
    1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2012-01582026-10-17
    1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2019-198712026-10-17
    1. “APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  7. CVE-2021-442072026-10-17
    1. “During C0017 , APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  8. CVE-2021-442282026-10-17
    1. “During C0017 , APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  9. CVE-2019-197812026-10-17
    1. “APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “The adversary began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE- 2020-10189)”

      cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

  10. CVE-2021-268552026-10-17
    1. “APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  11. CVE-2020-101892026-10-17
    1. “APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Blackfly: Espionage Group Targets Materials TechnologySymantec ↗
  2. 2022A Summary of APT41 Targeting U.S. State GovernmentsMandiant ↗
  3. 2021APT41 Resurfaces as Earth Baku With New Cyberespionage CampaignTrend Micro ↗
  4. 2020This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple ExploitsFireeye ↗
  5. 2019APT41: A Dual Espionage and Cyber Crime OperationFireEye ↗
  6. 2019APT41: A Dual Espionage and Cyber Crime OperationFireEye ↗

Take it with you

keyless · no signup

References

41 sources
  1. 1.securelist.com/winnti-faq-more-than-just-a-game/57585
  2. 2.securelist.com/winnti-more-than-just-a-game/37029
  3. 3.williamshowalter.com/a-universal-windows-bootkit
  4. 4.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-re…
  5. 5.securelist.com/games-are-over/70991
  6. 6.medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates…
  7. 7.dw.com/en/thyssenkrupp-victim-of-cyber-attack/a-36695341
  8. 8.bleepingcomputer.com/news/security/teamviewer-confirms-undisclosed-breach-f…
  9. 9.blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github
  10. 10.dw.com/en/bayer-points-finger-at-wicked-panda-in-cyberattack/…
  11. +31 more in the JSON record

Track APT41 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.