What public reporting says
APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.
APT41 threat group
APT41 is a threat group thought to operate from China, with suspected backing from the People's Republic of China. Public reporting links it to 80 attack techniques, and to attacks on automotive, business and services organisations, with 16 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.
- Attack techniques
- 80
- Countries and victims named
- 16
- Thought to operate from
- China
- Suspected backing
- People's Republic of China
- Other names
- 19
Built from public reporting, with every source listed below.
Overview
Who is APT41?
APT41 has 19 other names in security research. Below is what published reporting says about it, with a link to every report so you can check the detail yourself.
Also known as
G0096TA415BlackflyGrayflyLEADBARIUMWICKED SPIDERWICKED PANDABRONZE ATLASBRONZE EXPORTRed KelpieG0044
Security companies each give the same group their own name, so one group can have many.
Public reports about APT41 (32)
- Winnti Faq More Than Just a Gamesecurelist.com (opens in a new tab)
- Winnti More Than Just a Gamesecurelist.com (opens in a new tab)
- A Universal Windows Bootkitwilliamshowalter.com (opens in a new tab)
- Detecting Threat Actors in Recent German Industrial Attacks with Windows Defender Atpmicrosoft.com · 2017 (opens in a new tab)
- Games Are Oversecurelist.com (opens in a new tab)
- Winnti More Than Just Windows and Gates E4f03436031amedium.com (opens in a new tab)
- Thyssenkrupp Victim of Cyber Attackdw.com (opens in a new tab)
- Teamviewer Confirms Undisclosed Breach from 2016bleepingcomputer.com · 2016 (opens in a new tab)
How it works
How does APT41 attack? Stage by stage.
Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 80 linked to APT41, laid out from first look to final blow. Some techniques belong to more than one stage. Pick a stage to see them. Public reporting also lists 62 more specific variations of them, called sub-techniques.
Stage 7 of 15
14 techniquesHiding
Disguising what they are doing so it blends in with normal activity.
- T1014Rootkit
- T1027Obfuscated Files or Information
- T1036Masquerading
- T1055Process Injection
- T1070Indicator Removal
- T1078Valid Accounts
- T1134Access Token Manipulation
- T1140Deobfuscate/Decode Files or Information
- T1197BITS Jobs
- T1218System Binary Proxy Execution
- T1480Execution Guardrails
- T1542Pre-OS Boot
- T1574Hijack Execution Flow
- T1684Social Engineering
Targets
Who does APT41 go after?
The sectors and places named in public reporting about this group. If yours is on the list, it is worth knowing how they work and which flaws they use.
Sectors (16)
AutomotiveBusinessServicesCryptocurrencyEducationEnergyFinancialHealthcareHigh-TechIntergovernmentalMedia and EntertainmentPharmaceuticalsPrivate sectorRetailTelecommunicationsTravel
See threats by industry →Countries and victims named (16)
- 01China
- 02France
- 03Hong Kong
- 04India
- 05Italy
- 06Japan
- 07Myanmar
- 08Netherlands
- 09Singapore
- 10South Korea
- 11South Africa
- 12Switzerland
- 13Thailand
- 14Turkey
- 15United Kingdom
- 16United States
Free account
Is APT41 a risk to you?
A public profile tells you who a group is. Your account tells you whether it matters to you: we match the software you run to the flaws threat groups use, and we keep watching, so you hear about anything that affects you as soon as we know.
- Over 900 group profiles in the app, every claim backed by a quote and a source link.
- Your sector at a glance: which threat groups and ransomware gangs are hitting it.
- Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
- A PDF dossier on any group, ready to send to your board or your IT provider.
APT41 is a threat group thought to operate from China, with suspected backing from the People's Republic of China. Public reporting links it to 80 attack techniques, and to attacks on automotive, business and services organisations, with 16 countries and victims named.
Public reporting places APT41 as operating from China, with suspected backing from the People's Republic of China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.
In public reporting, sectors named include automotive, business, services, cryptocurrency and education, and 16 countries and victims are named, including China, France, Hong Kong and India.
Public reporting links APT41 to 80 attack techniques. Most of them are about hiding, staying in and looking around.
Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.
Get started
Find out what groups like this could use against you.
Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.
No card neededNothing to installIntelligence and alerts free