APT41

Overview

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Naming & attribution

APT41 is tracked under 4 names across the industry. It uses 82 documented ATT&CK techniques — more than 97% of the 174 groups tracked here. Activity attributed since at least 2012.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1599 Network Boundary Bridging — used by 1 of 174 groups
• T1480.001 Environmental Keying — used by 2 of 174 groups
• T1568.002 Domain Generation Algorithms — used by 2 of 174 groups
• T1595.003 Wordlist Scanning — used by 2 of 174 groups
• T1596.005 Scan Databases — used by 2 of 174 groups
• T1213.003 Code Repositories — used by 3 of 174 groups
• T1542.003 Bootkit — used by 3 of 174 groups
• T1574.006 Dynamic Linker Hijacking — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Wizard Spider Russia — 37 shared techniques (34% overlap)
• APT3 China — 31 shared techniques (33% overlap)
• FIN13 — 32 shared techniques (31% overlap)
• Dragonfly Russia — 31 shared techniques (29% overlap)
• APT39 Iran — 30 shared techniques (29% overlap)
• Aquatic Panda China — 26 shared techniques (29% overlap)

Targets

Automotive · Business · Cryptocurrency · Education · Energy · Finance · Healthcare · High-Tech · Intergovernmental · Media · Pharmaceuticals · Private sector · Retail · Services · Telecommunications · Travel

Regions

China · France · Hong Kong · India · Italy · Japan · Myanmar · Netherlands · Singapore · South Africa · South Korea · Switzerland · Thailand · Turkey · United Kingdom · United States

Capabilities

• Supply-chain compromise — ATT&CK T1195.002
• Exploitation of public-facing / client applications — ATT&CK T1190, T1203
• Custom malware/implant development — ATT&CK: 18 attributed custom malware families

TTPs — 82 techniques across 15 tactics

Tools & malware (32)

ASPXSpy · BITSAdmin · PlugX · Impacket · gh0st RAT · netstat · PowerSploit · ZxShell · KEYPLUG · Ping · LightSpy · DUSTPAN · Net · ipconfig · sqlmap · China Chopper · ShadowPad · MESSAGETAP · Mimikatz · certutil · njRAT · Empire · Cobalt Strike · pwdump · BLACKCOFFEE · MOPSLED · ROCKBOOT · dsquery · Winnti for Linux · DUSTTRAP · Derusbi · ftp

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Big airline heist APT41 likely behind a third-party attack on Air India — Rostovcev, N
• 2020 Global Threat Report — Crowdstrike