State-backedChina MITRE G0096

APT41

Also known as G0096, TA415, Blackfly, Grayfly, LEAD, BARIUM, WICKED SPIDER, WICKED PANDA, BRONZE ATLAS, BRONZE EXPORT, Red Kelpie, G0044, Earth Baku, Amoeba, HOODOO, Brass Typhoon, Winnti, Double Dragon, TG-2633, Leopard Typhoon

2mentions, 7 days

9mentions, 30 days

Nov 4, 2026last mentioned

APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.

Targets: Automotive, Business, Services, Cryptocurrency, Education, Energy, Financial, Healthcare, High-Tech, Intergovernmental, Media and Entertainment, Pharmaceuticals, Private sector, Retail, Telecommunications

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1005 Data from Local System T1008 Fallback Channels T1012 Query Registry T1014 Rootkit T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1027 Obfuscated Files or Information T1027.002 Software Packing T1030 Data Transfer Size Limits T1033 System Owner/User Discovery T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1037 Boot or Logon Initialization Scripts T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1055 Process Injection T1056.001 Keylogging T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1069 Permission Groups Discovery T1070.003 Clear Command History T1070.004 File Deletion T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1078 Valid Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1090 Proxy T1098.007 Additional Local or Domain Groups T1102.001 Dead Drop Resolver T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1110 Brute Force T1112 Modify Registry T1133 External Remote Services T1135 Network Share Discovery T1136.001 Local Account T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1197 BITS Jobs T1203 Exploitation for Client Execution T1213.003 Code Repositories T1218.001 Compiled HTML File T1218.011 Rundll32 T1480.001 Environmental Keying T1484.001 Group Policy Modification T1486 Data Encrypted for Impact T1496.001 Compute Hijacking T1542.003 Bootkit T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder T1550.002 Pass the Hash T1553.002 Code Signing T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1568.002 Domain Generation Algorithms T1569.002 Service Execution T1570 Lateral Tool Transfer T1574.001 DLL T1574.006 Dynamic Linker Hijacking T1588.002 Tool T1595.002 Vulnerability Scanning T1595.003 Wordlist Scanning T1596.005 Scan Databases T1599 Network Boundary Bridging T1684.001 Impersonation

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.