Home / Threat actors / Winnti Group
Winnti Group G0044
Also known as: Blackfly
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
6
Techniques
3
Malware and tools
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1583.001 Domains Stealth
T1014 Rootkit Defense Impairment
T1553.002 Code Signing Discovery
T1057 Process DiscoveryT1083 File and Directory Discovery Command and Control
T1105 Ingress Tool Transfer Malware and tools
- PipeMonMalwareS0501
- PlugXMalwareS0013
- Winnti for WindowsMalwareS0141
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.