Threat Actor Profile
Description
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
Confidence Score
Known Aliases
Tags
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (82)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['APT41', 'Wicked Panda', 'Brass Typhoon', 'BARIUM'],
'created': '2019-09-23T13:43:36.945Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[APT41](https://attack.mitre.org/groups/G0096) is a threat '
'group that researchers have assessed as Chinese '
'state-sponsored espionage group that also conducts '
'financially-motivated operations. Active since at least 2012, '
'[APT41](https://attack.mitre.org/groups/G0096) has been '
'observed targeting various industries, including but not '
'limited to healthcare, telecom, technology, finance, '
'education, retail and video game industries in 14 '
'countries.(Citation: apt41_mandiant) Notable behaviors '
'include using a wide range of malware and tools to complete '
'mission objectives. '
'[APT41](https://attack.mitre.org/groups/G0096) overlaps at '
'least partially with public reporting on groups including '
'BARIUM and [Winnti '
'Group](https://attack.mitre.org/groups/G0044).(Citation: '
'FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June '
'2021)\n',
'external_references': [{'external_id': 'G0096',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0096'},
{'description': '(Citation: Crowdstrike GTR2020 Mar '
'2020)',
'source_name': 'Wicked Panda'},
{'description': '(Citation: FireEye APT41 2019)',
'source_name': 'APT41'},
{'description': '(Citation: Microsoft Threat Actor '
'Naming July 2023)',
'source_name': 'Brass Typhoon'},
{'description': '(Citation: Microsoft Threat Actor '
'Naming July 2023)',
'source_name': 'BARIUM'},
{'description': 'Crowdstrike. (2020, March 2). 2020 '
'Global Threat Report. Retrieved '
'December 11, 2020.',
'source_name': 'Crowdstrike GTR2020 Mar 2020',
'url': 'https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf'},
{'description': 'FireEye. (2019). Double DragonAPT41, '
'a dual espionage andcyber crime '
'operationAPT41. Retrieved September '
'23, 2019.',
'source_name': 'FireEye APT41 2019',
'url': 'https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf'},
{'description': 'Fraser, N., et al. (2019, August 7). '
'Double DragonAPT41, a dual espionage '
'and cyber crime operation APT41. '
'Retrieved September 23, 2019.',
'source_name': 'FireEye APT41 Aug 2019',
'url': 'https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf'},
{'description': 'Mandiant. (n.d.). APT41, A DUAL '
'ESPIONAGE AND CYBER CRIME OPERATION. '
'Retrieved June 11, 2024.',
'source_name': 'apt41_mandiant',
'url': 'https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf'},
{'description': 'Microsoft . (2023, July 12). How '
'Microsoft names threat actors. '
'Retrieved November 17, 2023.',
'source_name': 'Microsoft Threat Actor Naming July '
'2023',
'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
{'description': 'Rostovcev, N. (2021, June 10). Big '
'airline heist APT41 likely behind a '
'third-party attack on Air India. '
'Retrieved August 26, 2021.',
'source_name': 'Group IB APT 41 June 2021',
'url': 'https://www.group-ib.com/blog/colunmtk-apt41/'}],
'id': 'intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7',
'modified': '2025-06-11T20:13:29.024Z',
'name': 'APT41',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Kyaw Pyiyt Htet, @KyawPyiytHtet',
'Nikita Rostovcev, Group-IB'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack', 'mobile-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '4.2'}