APT41

    ChinaUnknown

    Observation period

    82

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Automotive
    • Business
    • Services
    • Cryptocurrency
    • Education
    • Energy
    • Financial
    • Healthcare
    • High-Tech
    • Intergovernmental
    • Media and Entertainment
    • Pharmaceuticals
    • Private sector
    • Retail
    • Telecommunications
    • Travel

    Target countries according to source China, France, Hong Kong, India, Italy, Japan, Myanmar, Netherlands, Singapore, South Korea, South Africa, Switzerland, Thailand, Turkey, United Kingdom, United States

    Aliases

    • TA415
    • Blackfly
    • Grayfly
    • LEAD
    • BARIUM
    • WICKED SPIDER
    • WICKED PANDA
    • BRONZE ATLAS
    • BRONZE EXPORT
    • Red Kelpie
    • Earth Baku
    • Amoeba
    • HOODOO
    • Brass Typhoon
    • Winnti
    • Double Dragon
    • TG-2633
    • Leopard Typhoon
    • SPIRE CASTLE

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    ATT&CK campaigns

    Linked ATT&CK campaign profiles in which this group is named as an actor.

    External references

    Back to group overview