Início / Grupos de ameaça / APT41

APT41 G0096

🔔 Criar alerta

Também conhecido como: Wicked Panda, Brass Typhoon, BARIUM

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

11

CVEs associadas

102

Técnicas

32

Malwares e ferramentas

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-44228 Crítica · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“C0017: During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.”

CVE-2021-44207 Alta · 8.1 KEV Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

“C0017: During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.”

CVE-2021-26855 Crítica · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.”

CVE-2020-10189 Crítica · 9.8 KEV Zoho ManageEngine Desktop Central File Upload Vulnerability

“APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.”

CVE-2019-3396 Crítica · 9.8 KEV Ransomware Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2019-19871 ainda não publicada aqui

“APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.”

CVE-2019-19781 Crítica · 9.8 KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

“APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.”

CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2015-1641 Alta · 7.8 KEV Microsoft Office Memory Corruption Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

CVE-2012-0158 Alta · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

“APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”

Técnicas por tática

Reconhecimento

T1595.002 Vulnerability Scanning T1595.003 Wordlist Scanning T1596.005 Scan Databases

Desenvolvimento de recursos

T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1197 BITS Jobs T1203 Exploitation for Client Execution T1569.002 Service Execution T1574.001 DLL T1574.006 Dynamic Linker Hijacking

Persistência

T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1197 BITS Jobs T1542.003 Bootkit T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1037 Boot or Logon Initialization Scripts T1053.005 Scheduled Task T1055 Process Injection T1078 Valid Accounts T1098.007 Additional Local or Domain Groups T1484.001 Group Policy Modification T1543.003 Windows Service T1546.008 Accessibility Features T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1014 Rootkit T1027 Obfuscated Files or Information T1027.002 Software Packing T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.003 Clear Command History T1070.004 File Deletion T1078 Valid Accounts T1197 BITS Jobs T1218.001 Compiled HTML File T1218.011 Rundll32 T1480.001 Environmental Keying T1542.003 Bootkit T1574.001 DLL T1574.006 Dynamic Linker Hijacking T1684.001 Impersonation

Comprometimento de defesas

T1112 Modify Registry T1484.001 Group Policy Modification T1553.002 Code Signing T1599 Network Boundary Bridging T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1056.001 Keylogging T1110 Brute Force T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers

Descoberta

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1069 Permission Groups Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1135 Network Share Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Coleta

T1005 Data from Local System T1056.001 Keylogging T1213.003 Code Repositories T1560.001 Archive via Utility

Comando e controle

T1008 Fallback Channels T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.004 DNS T1090 Proxy T1102.001 Dead Drop Resolver T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1568.002 Domain Generation Algorithms

Exfiltração

T1030 Data Transfer Size Limits

Impacto

T1486 Data Encrypted for Impact T1496.001 Compute Hijacking

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.