Home / Threat actors / APT41

APT41 G0096

🔔 Create alert

Also known as: Wicked Panda, Brass Typhoon, BARIUM

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

11

associated CVEs

102

Techniques

32

Malware and tools

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-44228 Critical · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“C0017: During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.”

CVE-2021-44207 High · 8.1 KEV Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

“C0017: During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.”

CVE-2021-26855 Critical · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.”

CVE-2020-10189 Critical · 9.8 KEV Zoho ManageEngine Desktop Central File Upload Vulnerability

“APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.”

CVE-2019-3396 Critical · 9.8 KEV Ransomware Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2019-19871 not published here yet

“APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.”

CVE-2019-19781 Critical · 9.8 KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

“APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.”

CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2015-1641 High · 7.8 KEV Microsoft Office Memory Corruption Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2012-0158 High · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

Techniques by tactic

Reconnaissance

T1595.002 Vulnerability Scanning T1595.003 Wordlist Scanning T1596.005 Scan Databases

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1197 BITS Jobs T1203 Exploitation for Client Execution T1569.002 Service Execution T1574.001 DLL T1574.006 Dynamic Linker Hijacking

Persistence

T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1197 BITS Jobs T1542.003 Bootkit T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1055 Process Injection T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1484.001 Group Policy Modification T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Stealth

T1014 Rootkit T1027 Obfuscated Files or Information T1027.002 Software Packing T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.003 Clear Command History T1070.004 File Deletion T1078 Valid Accounts T1197 BITS Jobs T1218.001 Compiled HTML File T1218.011 Rundll32 T1480.001 Environmental Keying T1542.003 Bootkit T1574.001 DLL T1574.006 Dynamic Linker Hijacking T1684.001 Impersonation

Defense Impairment

T1112 Modify Registry T1484.001 Group Policy Modification T1553.002 Code Signing T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1056.001 Keylogging T1110 Brute Force T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers

Discovery

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1069 Permission Groups Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1056.001 Keylogging T1213.003 Code Repositories T1560.001 Archive via Utility

Command and Control

T1008 Fallback Channels T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1090 Proxy T1102.001 Dead Drop Resolver T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1568.002 Domain Generation Algorithms

Exfiltration

T1030 Data Transfer Size Limits

Impact

T1486 Data Encrypted for Impact T1496.001 Compute Hijacking

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.