APT41 (G0096) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

CISA Known Exploited

About APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

View MITRE record ↗

Techniques by Tactic (82)

Reconnaissance

T1595.002 Vulnerability ScanningT1595.003 Wordlist ScanningT1596.005 Scan Databases

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1566.001 Spearphishing Attachment

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.004 Unix ShellT1197 BITS JobsT1203 Exploitation for Client ExecutionT1569.002 Service ExecutionT1574.001 DLLT1574.006 Dynamic Linker Hijacking

Persistence

T1037 Boot or Logon Initialization ScriptsT1053.005 Scheduled TaskT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1112 Modify RegistryT1133 External Remote ServicesT1136.001 Local AccountT1197 BITS JobsT1542.003 BootkitT1543.003 Windows ServiceT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1037 Boot or Logon Initialization ScriptsT1053.005 Scheduled TaskT1055 Process InjectionT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1484.001 Group Policy ModificationT1543.003 Windows ServiceT1546.008 Accessibility FeaturesT1547.001 Registry Run Keys / Startup Folder

Stealth

T1014 RootkitT1027 Obfuscated Files or InformationT1027.002 Software PackingT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1070.003 Clear Command HistoryT1070.004 File DeletionT1078 Valid AccountsT1197 BITS JobsT1218.001 Compiled HTML FileT1218.011 Rundll32T1480.001 Environmental KeyingT1542.003 BootkitT1574.001 DLLT1574.006 Dynamic Linker HijackingT1684.001 Impersonation

Defence Impairment

T1112 Modify RegistryT1484.001 Group Policy ModificationT1553.002 Code SigningT1599 Network Boundary BridgingT1685 Disable or Modify ToolsT1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1056.001 KeyloggingT1110 Brute ForceT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers

Discovery

T1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1550.002 Pass the HashT1570 Lateral Tool Transfer

Collection

T1005 Data from Local SystemT1056.001 KeyloggingT1213.003 Code RepositoriesT1560.001 Archive via Utility

Command & Control

T1008 Fallback ChannelsT1071.001 Web ProtocolsT1071.002 File Transfer ProtocolsT1071.004 DNST1090 ProxyT1102.001 Dead Drop ResolverT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1568.002 Domain Generation Algorithms

Exfiltration

T1030 Data Transfer Size Limits

Impact

T1486 Data Encrypted for ImpactT1496.001 Compute Hijacking

Toolsets (32)

🐛

ASPXSpy S0073

Malware · Windows

🐛

BLACKCOFFEE S0069

Malware · Windows

🐛

China Chopper S0020

Malware · Windows

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

DUSTPAN S1158

Malware · Windows

🐛

DUSTTRAP S1159

Malware · Windows

🐛

Derusbi S0021

Malware · Windows, Linux

🐛

KEYPLUG S1051

Malware · Linux, Windows

🐛

LightSpy S1185

Malware · Android, Windows, iOS, macOS

🐛

MESSAGETAP S0443

Malware · Linux

🐛

MOPSLED S1221

Malware · Linux

🐛

PlugX S0013

Malware · Windows

🐛

ROCKBOOT S0112

Malware · Windows

🐛

ShadowPad S0596

Malware · Windows

🐛

Winnti for Linux S0430

Malware · Linux

🐛

ZxShell S0412

Malware · Windows

🐛

gh0st RAT S0032

Malware · Windows, macOS

🐛

njRAT S0385

Malware · Windows

🔧

BITSAdmin S0190

Tool · Windows

🔧

Empire S0363

Tool · Linux, macOS, Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Ping S0097

Tool

🔧

PowerSploit S0194

Tool · Windows

🔧

certutil S0160

Tool · Windows

🔧

dsquery S0105

Tool · Windows

🔧

ftp S0095

Tool · Linux, Windows, macOS

🔧

ipconfig S0100

Tool

🔧

netstat S0104

Tool

🔧

pwdump S0006

Tool · Windows

🔧

sqlmap S0225

Tool

CVEs Referenced (3 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

CVE-2017-8625View full details on NVD

References & Reports (6)

↑