Trusted Design

APT41

アクターID: G0096

· MITRE Pageへのリンク

脅威アクターの詳細

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

脅威アクターの別名・別称

APT41
Wicked Panda
Brass Typhoon
BARIUM

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1067 - Bootkit
• T1557 - Adversary-in-the-Middle
• T1583 - Acquire Infrastructure
• T1596.003 - Digital Certificates
• T1499.001 - OS Exhaustion Flood
• T1123 - Audio Capture
• T1539 - Steal Web Session Cookie
• T1560.003 - Archive via Custom Method
• T1584.008 - Network Devices
• T1195.001 - Compromise Software Dependencies and Development Tools
• T1071.004 - DNS
• T1218.013 - Mavinject
• T1587.001 - Malware
• T1592.001 - Hardware
• T1176.001 - Browser Extensions
• T1598.003 - Spearphishing Link
• T1089 - Disabling Security Tools
• T1103 - AppInit DLLs
• T1007 - System Service Discovery
• T1120 - Peripheral Device Discovery
• T1106 - Native API
• T1584.003 - Virtual Private Server
• T1536 - Revert Cloud Instance
• T1140 - Deobfuscate/Decode Files or Information
• T1562 - Impair Defenses
• T1684 - Social Engineering
• T1032 - Standard Cryptographic Protocol
• T1562.004 - Disable or Modify System Firewall
• T1059.009 - Cloud API
• T1562.012 - Disable or Modify Linux Audit System
• T1574.008 - Path Interception by Search Order Hijacking
• T1552.004 - Private Keys
• T1583.004 - Server
• T1547.003 - Time Providers
• T1546.005 - Trap
• T1590.006 - Network Security Appliances
• T1177 - LSASS Driver
• T1045 - Software Packing
• T1578.003 - Delete Cloud Instance
• T1219.001 - IDE Tunneling
• T1588.001 - Malware
• T1055.004 - Asynchronous Procedure Call
• T1059.008 - Network Device CLI
• T1497.002 - User Activity Based Checks
• T1041 - Exfiltration Over C2 Channel
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1048 - Exfiltration Over Alternative Protocol
• T1547.006 - Kernel Modules and Extensions
• T1097 - Pass the Ticket
• T1686.002 - Network Device Firewall
• T1157 - Dylib Hijacking
• T1059.011 - Lua
• T1208 - Kerberoasting
• T1027 - Obfuscated Files or Information
• T1573 - Encrypted Channel
• T1218.010 - Regsvr32
• T1002 - Data Compressed
• T1566.004 - Spearphishing Voice
• T1570 - Lateral Tool Transfer
• T1574.009 - Path Interception by Unquoted Path
• T1001.003 - Protocol or Service Impersonation
• T1030 - Data Transfer Size Limits
• T1564.003 - Hidden Window
• T1591.004 - Identify Roles
• T1070.009 - Clear Persistence
• T1537 - Transfer Data to Cloud Account
• T1556.005 - Reversible Encryption
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1668 - Exclusive Control
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1574.002 - DLL Side-Loading
• T1548.006 - TCC Manipulation
• T1027.007 - Dynamic API Resolution
• T1037.001 - Logon Script (Windows)
• T1055.015 - ListPlanting
• T1008 - Fallback Channels

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1574.002)
• CVE-2015-5749 (T1574.002)
• CVE-2016-1898 (T1564.003)
• CVE-2016-1897 (T1574.002)
• CVE-2015-7261 (T1564.003)
• CVE-2015-6036 (T1564.003)
• CVE-2015-7262 (T1564.003)
• CVE-2015-0932 (T1574.002)
• CVE-2010-3081 (T1574.002)
• CVE-2017-16929 (T1574.002)
• CVE-2025-31125 (T1564.003)
• CVE-2025-68645 (T1574.002)
• CVE-2014-4114 (T1027.007)
• CVE-2017-0143 (T1027.007)
• CVE-2013-2595 (T1027)
• CVE-2013-6282 (T1564.003)
• CVE-2012-1856 (T1027.007)
• CVE-2014-6332 (T1027.007)
• CVE-2012-0158 (T1027.007)
• CVE-2015-1701 (T1027.007)
• CVE-2012-4969 (T1027.007)
• CVE-2014-1776 (T1574.002)
• CVE-2013-3660 (T1564.003)
• CVE-2010-0806 (T1547.013)
• CVE-2015-2360 (T1027.007)
• CVE-2010-4398 (T1037.001)
• CVE-2025-55182 (T1564.003)
• CVE-2023-1389 (T1574.002)
• CVE-2025-13928 (T1564.003)
• CVE-2025-24893 (T1037.001)
• CVE-2025-34026 (T1564.003)
• CVE-2025-55184 (T1564.003)
• CVE-2014-4113 (T1027.007)
• CVE-2015-0057 (T1027.007)
• CVE-2014-4148 (T1027.007)
• CVE-2012-0611 (T1218.010)
• CVE-2015-3636 (T1157)
• CVE-2015-5119 (T1564.003)
• CVE-2015-5122 (T1574.002)
• CVE-2015-1427 (T1027)
• CVE-2015-1770 (T1027.007)
• CVE-2015-2545 (T1027.007)
• CVE-2015-2546 (T1564.003)
• CVE-2015-3785 (T1564.003)
• CVE-2015-5897 (T1574.002)
• CVE-2015-7645 (T1564.003)
• CVE-2017-0199 (T1027.007)
• CVE-2017-12149 (T1564.003)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1574.002)
• CVE-2015-3113 (T1564.003)
• CVE-2015-2590 (T1564.003)
• CVE-2015-2424 (T1564.003)
• CVE-2015-0097 (T1564.003)
• CVE-2014-1761 (T1564.003)
• CVE-2015-2502 (T1027.007)
• CVE-2014-6271 (T1037.001)
• CVE-2013-2094 (T1027)
• CVE-2015-8562 (T1037.001)
• CVE-2015-7808 (T1002)
• CVE-2012-1889 (T1177)
• CVE-2016-1990 (T1564.003)
• CVE-2016-1991 (T1564.003)
• CVE-2016-1010 (T1574.002)
• CVE-2016-0984 (T1574.002)
• CVE-2016-1001 (T1574.002)
• CVE-2016-0998 (T1574.002)
• CVE-2015-1641 (T1564.003)
• CVE-2015-0313 (T1564.003)
• CVE-2015-0359 (T1134)
• CVE-2014-0329 (T1574.002)
• CVE-2015-5130 (T1574.002)
• CVE-2015-5134 (T1574.002)
• CVE-2015-5539 (T1574.002)
• CVE-2015-5557 (T1574.002)
• CVE-2015-5563 (T1574.002)
• CVE-2015-5559 (T1574.002)
• CVE-2015-5540 (T1574.002)
• CVE-2015-5561 (T1574.002)
• CVE-2015-5551 (T1574.002)
• CVE-2015-5564 (T1574.002)
• CVE-2015-5565 (T1574.002)
• CVE-2015-5550 (T1574.002)
• CVE-2015-5566 (T1574.002)
• CVE-2015-5127 (T1574.002)
• CVE-2015-5556 (T1574.002)
• CVE-2015-3628 (T1564.003)
• CVE-2015-2852 (T1218.010)
• CVE-2015-2854 (T1564.003)
• CVE-2015-2853 (T1564.003)
• CVE-2015-7755 (T1564.003)
• CVE-2016-1287 (T1574.002)
• CVE-2015-6585 (T1564.003)
• CVE-2015-6022 (T1564.003)
• CVE-2015-8286 (T1574.002)
• CVE-2015-8287 (T1574.002)
• CVE-2016-1562 (T1564.003)
• CVE-2016-2342 (T1209)
• CVE-2016-2343 (T1574.002)
• CVE-2017-0263 (T1564.003)
• CVE-2016-6532 (T1097)
• CVE-2016-9494 (T1002)
• CVE-2016-9496 (T1668)
• CVE-2016-9495 (T1218.010)
• CVE-2017-3212 (T1564.003)
• CVE-2025-61882 (T1584.008)
• CVE-2015-0311 (T1564.003)
• CVE-2012-3213 (T1574.002)
• CVE-2012-4792 (T1547.013)
• CVE-2012-1258 (T1668)
• CVE-2015-0336 (T1564.003)
• CVE-2014-3153 (T1564.003)
• CVE-2014-4322 (T1037.001)
• CVE-2015-3105 (T1574.002)
• CVE-2014-0497 (T1564.003)
• CVE-2014-8361 (T1556.005)
• CVE-2017-17215 (T1564.003)
• CVE-2013-0074 (T1030)
• CVE-2012-0507 (T1574.002)
• CVE-2013-2551 (T1002)
• CVE-2014-0569 (T1574.002)
• CVE-2014-0515 (T1564.003)
• CVE-2015-0310 (T1564.003)
• CVE-2012-4681 (T1574.002)
• CVE-2012-1876 (T1002)
• CVE-2015-0071 (T1002)
• CVE-2015-1761 (T1564.003)
• CVE-2014-8440 (T1574.002)
• CVE-2011-3402 (T1564.003)
• CVE-2010-2883 (T1574.002)
• CVE-2014-7247 (T1037.001)
• CVE-2013-2678 (T1564.003)
• CVE-2010-0738 (T1002)
• CVE-2015-2426 (T1564.003)
• CVE-2008-1436 (T1027.007)
• CVE-2010-0232 (T1574.002)
• CVE-2014-3393 (T1574.002)
• CVE-2012-6422 (T1030)
• CVE-2014-3897 (T1564.003)
• CVE-2015-2387 (T1564.003)
• CVE-2011-1255 (T1548.006)
• CVE-2011-0611 (T1574.002)
• CVE-2013-5990 (T1037.001)
• CVE-2016-0189 (T1002)
• CVE-2017-7255 (T1134)
• CVE-2026-0723 (T1574.002)
• CVE-2026-20127 (T1564.003)
• CVE-2017-0001 (T1564.003)
• CVE-2010-1553 (T1209)
• CVE-2014-6352 (T1027.007)
• CVE-2015-0016 (T1574.002)
• CVE-2012-2539 (T1564.003)
• CVE-2013-7331 (T1027.007)
• CVE-2009-3129 (T1209)
• CVE-2016-1019 (T1564.003)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2013-3906 (T1564.003)
• CVE-2012-0056 (T1027)
• CVE-2010-3333 (T1209)
• CVE-2014-8439 (T1574.002)
• CVE-2014-0556 (T1574.002)
• CVE-2015-5560 (T1574.002)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1574.002)
• CVE-2010-1297 (T1574.002)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0634 (T1564.003)
• CVE-2015-4902 (T1564.003)
• CVE-2025-55183 (T1574.002)
• CVE-2014-0322 (T1027.007)
• CVE-2015-3456 (T1564.003)
• CVE-2015-6034 (T1564.003)
• CVE-2014-6324 (T1564.003)
• CVE-2014-2273 (T1564.003)
• CVE-2025-13335 (T1574.002)
• CVE-2025-13927 (T1564.003)
• CVE-2026-1102 (T1002)
• CVE-2015-5477 (T1574.002)
• CVE-2011-3544 (T1574.002)
• CVE-2014-7911 (T1574.002)
• CVE-2013-2465 (T1574.002)
• CVE-2010-0188 (T1591.004)
• CVE-2012-5054 (T1027)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2010-2572 (T1002)
• CVE-2017-8570 (T1564.003)
• CVE-2015-2419 (T1002)
• CVE-2016-4117 (T1564.003)
• CVE-2025-54313 (T1564.003)
• CVE-2025-66478 (T1219.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る