Chengdu 404

Chengdu 404 is a China-linked offensive cyber contractor and intrusion operator associated with APT41, also widely connected to the Winnti Group ecosystem. It has been described as a self-identified cybersecurity firm based in Chengdu, China, and as one of the more prolific Chinese advanced persistent threat operators at its peak. Public reporting and U.S. government actions have linked the company and its operators to state-directed activity and to work performed on behalf of Chinese security services, placing it within the broader PRC contractor ecosystem that blends private firms, subcontractors, and government tasking. Chengdu 404 has been tied to global intrusions against more than 100 targets worldwide and to operations affecting strategically significant sectors. A notable publicly attributed case involved ransomware attacks in Taiwan in 2020 against organizations in energy, chemicals, telecommunications, and semiconductors. In that campaign, the operators reportedly obtained persistent access to multiple victims before distributing ransomware through centralized management systems, indicating a workflow that combined network compromise, persistence, post-exploitation, and disruptive deployment. The same reporting linked the operators to APT41. The company is also connected to the Winnti and ShadowPad tooling ecosystem. Reporting on leaked materials from another Chinese contractor referenced a Linux implant controller name previously cited in an FBI indictment of Chengdu 404, reinforcing overlap with long-observed Chinese intrusion tradecraft and shared malware infrastructure across affiliated firms. Chengdu 404 has additionally been characterized as a prime contractor or higher-tier competitor to other Chinese hacking-for-hire firms, with multiple offices and comparatively stable business operations. Known aliases include chengdu404 and chengdu_404. Chengdu 404 is best understood not as an isolated malware cluster but as part of a broader Chinese state-aligned contractor network in which personnel, tooling, and operational responsibilities may be shared across companies and campaigns. Its dominant activity profile is consistent with state-linked espionage and strategic cyber operations, with occasional use of ransomware as a disruptive or coercive mechanism rather than purely criminal extortion.