type: intrusion-set
spec_version: 2.1
id: intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7
created: 2019-09-23T13:43:36.945Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0096
external_id: G0096
source_name: Wicked Panda
description: (Citation: Crowdstrike GTR2020 Mar 2020)
source_name: APT41
description: (Citation: FireEye APT41 2019)
source_name: Brass Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: BARIUM
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Crowdstrike GTR2020 Mar 2020
description: Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
url: https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
source_name: FireEye APT41 2019
description: FireEye. (2019). Double DragonAPT41, a dual espionage andcyber crime operationAPT41. Retrieved September 23, 2019.
url: https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
source_name: FireEye APT41 Aug 2019
description: Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
url: https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
source_name: apt41_mandiant
description: Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.
url: https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Group IB APT 41 June 2021
description: Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.
url: https://www.group-ib.com/blog/colunmtk-apt41/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-06-11T20:13:29.024Z
name: APT41
description: [APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

aliases: APT41
Wicked Panda
Brass Typhoon
BARIUM
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 4.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet
Nikita Rostovcev, Group-IB
x_mitre_domains: enterprise-attack
mobile-attack