Loading threat actor…
APT41 is a China-based, state-sponsored threat actor that conducts cyberespionage alongside financially motivated criminal operations. It is also tracked as Barium, Brass Typhoon, Wicked Panda, and Double Dragon, and is associated with the broader Winnti ecosystem, whose constituent groups and vendor tracking boundaries are not always equivalent. Its activities include espionage supporting Chinese state interests, ransomware deployment, cryptojacking, and theft of video-game currency. APT41 targets government organizations and commercial enterprises, including gaming and gambling companies, software producers, and billing and payment services. It has attacked multiple U.S. state governments through a zero-day vulnerability in the USAHERDS application. Initial-access methods include exploitation of public-facing applications, spearphishing with compiled HTML attachments, third-party VPN access, and software supply-chain compromise. Documented exploitation includes CVE-2020-10189 in Zoho ManageEngine Desktop Central and CVE-2019-19781 in Citrix appliances. Its supply-chain operations have inserted malicious code into legitimate, signed software distributed to end users. Following compromise, APT41 uses credential dumping and DCSync to obtain password hashes, abuses valid accounts, and moves laterally through RDP and remote command execution. Its tooling includes Cobalt Strike and custom backdoors. Persistence mechanisms include modified Windows services, startup entries, scheduled tasks, and newly created local accounts. DLL side-loading, phantom DLL hijacking, process injection, and abuse of legitimate administrative utilities support stealthy execution and defense evasion. The group profiles compromised systems, exfiltrates data, adapts to incident-response actions, and has maintained access for many months. Its ransomware activity includes deploying Encryptor RaaS to encrypt victim files and demand payment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
70 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
62 malware families attributed to this actor across reporting.
57 additional families tracked in Mallory.
42 CVEs this actor has used in observed campaigns. 42 of them exploited in the wild.
APT29 has exploited CVE-2019-19781 for Citrix to gain access. APT41 exploited CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.
APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
The table lists CVE-2019-11510 in Ivanti Connect Secure and Policy Secure, multiple associated threat actors, and nine ransomware associations.
Recently Exploited Vulnerabilities by MISSION2025 CVE-2017-0199 CVE-2017-0147 CVE-2017-11882 CVE-2021-44228
37 more CVEs tied to this actor tracked in Mallory.
2,030 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as associated with exploitation of CVE-2019-11510; not attributed to the infrastructure activity investigated in this article.
Mentioned only as a threat actor network connected to i-SOON in background discussion. The content provides no operational details or connection between APT41 and ZRON.
Mentioned only as a threat actor network connected to i-SOON in background discussion. No connection to ZRON or the current leaked dataset is established.
Used as a comparison with the less publicly scrutinized APT15. The article cautions against conflating these separate China-aligned operations and does not describe APT41-specific attacks, malware, or techniques.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.