BTCintel
nodeok
tip971,672
mempool70,839 tx
node next1.08 sat/vB
retarget40 blocks
chainmainnet

threat actor

APT41

unknownentity:threat_actor

APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id
apt41
kind
threat actor
status
unknown
aliases
Amoeba · BARIUM · Blackfly · Brass Typhoon · BRONZE ATLAS · BRONZE EXPORT · Double Dragon · Earth Baku · G0044 · G0096 · Grayfly · HOODOO · LEAD · Leopard Typhoon · Red Kelpie · SPIRE CASTLE · TA415 · TG-2633 · Wicked Panda · WICKED PANDA · WICKED SPIDER · Winnti
jurisdictions
—
claims naming it
0 · 0 attributions · 18 relations · 0 events

Identifiers

Relations

  • MITRE ATT&CK Enterpriserecords thatAPT41usesASPXSpy
    fetch —sha256 dc1639caa5501d72
    rel_65btcintel:relations:65@v1 sha256:e84cd124771f6d90
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesPlugX
    fetch —sha256 dc1639caa5501d72
    rel_66btcintel:relations:66@v1 sha256:d2ba7fb62e789f5f
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesgh0st RAT
    fetch —sha256 dc1639caa5501d72
    rel_67btcintel:relations:67@v1 sha256:80d67f3484e57acc
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesZxShell
    fetch —sha256 dc1639caa5501d72
    rel_68btcintel:relations:68@v1 sha256:b3f644c035ada007
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesKEYPLUG
    fetch —sha256 dc1639caa5501d72
    rel_69btcintel:relations:69@v1 sha256:a1f7dbd0db511357
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesLightSpy
    fetch —sha256 dc1639caa5501d72
    rel_70btcintel:relations:70@v1 sha256:5d20e9a4a7c96537
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesDUSTPAN
    fetch —sha256 dc1639caa5501d72
    rel_71btcintel:relations:71@v1 sha256:7e1cabf0d4d5265f
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesChina Chopper
    fetch —sha256 dc1639caa5501d72
    rel_72btcintel:relations:72@v1 sha256:e509f88f78584e4d
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesShadowPad
    fetch —sha256 dc1639caa5501d72
    rel_73btcintel:relations:73@v1 sha256:0a86a2eef98164ff
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesMESSAGETAP
    fetch —sha256 dc1639caa5501d72
    rel_74btcintel:relations:74@v1 sha256:640f8a8a22dc4bda
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesnjRAT
    fetch —sha256 dc1639caa5501d72
    rel_75btcintel:relations:75@v1 sha256:e34a82256350a1d8
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesCobalt Strike
    fetch —sha256 dc1639caa5501d72
    rel_76btcintel:relations:76@v1 sha256:02fd4ebcdc6c61b0
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesBLACKCOFFEE
    fetch —sha256 dc1639caa5501d72
    rel_77btcintel:relations:77@v1 sha256:7d7e864800ce266c
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesMOPSLED
    fetch —sha256 dc1639caa5501d72
    rel_78btcintel:relations:78@v1 sha256:8746a2d3a5c13d22
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesROCKBOOT
    fetch —sha256 dc1639caa5501d72
    rel_79btcintel:relations:79@v1 sha256:7ff625248f9ab822
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesWinnti for Linux
    fetch —sha256 dc1639caa5501d72
    rel_80btcintel:relations:80@v1 sha256:c07c785a7637a8e9
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesDUSTTRAP
    fetch —sha256 dc1639caa5501d72
    rel_81btcintel:relations:81@v1 sha256:df5e6e5cc74e9c67
    confidenceauthority data · 60
  • MITRE ATT&CK Enterpriserecords thatAPT41usesDerusbi
    fetch —sha256 dc1639caa5501d72
    rel_82btcintel:relations:82@v1 sha256:db632c0bd4bdaee6
    confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.