Threat intelligence
- Suspected origin
- China
- First seen
- 2012-01-01 00:00:00
- Motivation
- Financial crime, Information theft and espionage
- Targeted sectors
- Construction, Defense, Education, Energy, Financial, Government, Healthcare, High-Tech, Hospitality, Manufacturing, Media, Oil and gas, Petrochemical, Pharmaceutical, Retail, Shipping and Logistics, Telecommunications, Transportation, Online video game companies
- TLP
- WHITE
(FireEye) FireEye Threat Intelligence assesses with high confidence that APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control. Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely state-sponsored activity. This is remarkable because explicit financially motivated targeting is unusual among Chinese state-sponsored threat groups, and evidence suggests these two motivations were balanced concurrently from 2014 onward.
• APT41 overlaps at least partically with public reporting on group including Barium and Winnti Group, Wicked Panda. In some cases the primary observed similarity in the publicly reported Winnti activity was the use of the same malware – including HIGHNOON – across otherwise separate clusters of activity.
• Previous FireEye Threat Intelligence reporting on the use of HIGHNOON and related activity was grouped together under both Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon and Mana, although we now understand this to be the work of several Chinese cyber espionage groups that share tools and digital certificates.
• APT41 reflects our current understanding of what was previously reported as GREF, as well as additional indicators and activity gathered during our extensive review of our intelligence holdings.
APT 41 has 2 subgroups:
1. Subgroup: Earth Longzhi
2. Subgroup: Earth Freybug
Also see Earth Lusca and RedGolf.
Also known as
APT41BARIUMBlackflyBrass TyphoonBrazenBambooBronze AtlasDouble DragonEarth BakuG0096GrayflyRed KelpieSparklingGoblinTA415TG-2633Wicked Panda
Vulnerabilities exploited
Tooling and malware
ASPXSpyBLACKCOFFEEChina ChopperCobalt StrikeDerusbiDUSTPANDUSTTRAPgh0st RATKEYPLUGLightSpyMESSAGETAPMOPSLEDnjRATPlugXROCKBOOTShadowPadWinnti for LinuxZxShellBITSAdmincertutildsqueryEmpireftpImpacketipconfigMimikatzNetnetstatPingPowerSploitpwdumpsqlmap
MITRE ATT&CK techniques
T1005 Data from Local SystemT1008 Fallback ChannelsT1090 ProxyT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1110 Brute ForceT1555 Credentials from Password StoresT1112 Modify RegistryT1599 Network Boundary BridgingT1685 Disable or Modify ToolsT1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1135 Network Share DiscoveryT1047 Windows Management InstrumentationT1203 Exploitation for Client ExecutionT1030 Data Transfer Size LimitsT1486 Data Encrypted for ImpactT1190 Exploit Public-Facing ApplicationT1570 Lateral Tool TransferT1037 Boot or Logon Initialization ScriptsT1133 External Remote ServicesT1014 RootkitT1027 Obfuscated Files or InformationT1055 Process InjectionT1078 Valid AccountsT1197 BITS Jobs
Coverage 1
vulnerability
In early 2026, a complex APT campaign targeting diplomatic agencies in Central Asia utilized a UEFI bootkit dubbed BlackX, which was similar to the previously known BlackLotus. The campaign involved deploying a malicious…
