Skip to content
skopnix
← Adversaries

File · Winnti Group · Unknown · refreshed 2026-10-18

Winnti Group

  • Blackfly

MITRE G0044 ↗

Winnti Group — ATT&CK roseWG

attack rose · 6 techniques across 5 tactics

Analyst brief

Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

6 techniques · 5 of 15 tactics

  1. Resource development

    1 technique

  2. Stealth

    1 technique

  3. Defense impairment

    1 technique

  4. Discovery

    2 techniques

  5. Command and control

    1 technique

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
PipeMonS0501 ↗
Winnti for WindowsS0141 ↗
PlugXS0013 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

3 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Primary-source reports

linked, never re-hosted
  1. 2023Blackfly: Espionage Group Targets Materials TechnologySymantec ↗

Take it with you

keyless · no signup

References

6 sources
  1. 1.attack.mitre.org/groups/G0044
  2. 2.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-…
  3. 3.401trg.github.io/pages/burning-umbrella.html
  4. 4.securelist.com/winnti-more-than-just-a-game/37029
  5. 5.web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/u…
  6. 6.securelist.com/games-are-over/70991

Track Winnti Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.