APT41 - G0096

Created: 2019-09-23T13:43:36.945Z

Modified: 2023-03-23T15:45:58.846Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

APT41,Wicked Panda

Description

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

Techniques Used

APT41 has added user accounts to the User and Admin groups.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

APT41 has obtained and used tools such as

Mimikatz,

pwdump,

PowerSploit, and

Windows Credential Editor.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT41 has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

APT41 has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT41 has used rundll32.exe to execute a loader.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|