G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.Citationapt41_mandiant Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.CitationFireEye APT41 Aug 2019CitationGroup IB APT 41 June 2021
Security context for executives and security teams
APT41 matters because ATT&CK describes it as a long-running group assessed in public reporting as conducting both state-sponsored espionage and financially motivated operations across many industries and countries. For leaders, the key decision value is not the name alone; it is whether the organization can withstand the behaviors associated with this group: exploitation of Internet-facing applications, web shells, credential dumping, remote access tooling, administrative utility abuse, and rapid adaptation to disclosed and zero-day vulnerabilities in at least one attributed campaign.
Executive priority
Prioritize APT41 as a resilience and readiness use case for exposed applications, identity compromise, and incident response speed. The C0017 relationship highlights compromise of U.S. state government networks through vulnerable Internet-facing web applications, making this especially relevant to vulnerability management, asset inventory, patch prioritization, and evidence that externally exposed systems are monitored. The APT41 DUST relationship adds relevance for organizations in shipping, logistics, media, and internationally distributed operations, but local targeting risk should be assessed with threat intelligence rather than assumed.
Technical view
ATT&CK provides no official detection text and no tactics/platforms directly on the group object, so defenders should validate coverage from the relationships. The associated software set includes credential dumpers such as Mimikatz and pwdump; web shells such as China Chopper and ASPXSpy; remote access/post-exploitation tools such as PlugX, gh0st RAT, Cobalt Strike, Empire, PowerSploit, and Impacket; and administrative or transfer utilities such as Net, dsquery, ipconfig, netstat, ping, ftp, certutil, and BITSAdmin. SOC and IR teams should test whether controls can connect external web exploitation, web shell persistence, credential access, Active Directory discovery, lateral movement tooling, and unusual file transfer into a single investigation narrative.
Likely telemetry
- Internet-facing web application access logs, error logs, upload events, and web server process execution evidence
- Endpoint process creation, command-line, parent-child process, module/script, and PowerShell telemetry where available
- Windows authentication, credential access, Active Directory query, service creation, and administrative share activity logs
- Network connection metadata, DNS, proxy, firewall, and egress records for unusual remote access or file transfer behavior
- File integrity and web root monitoring for unexpected ASPX or other web shell-like artifacts
Detection direction
- Because no official ATT&CK detection guidance is supplied for this group, build detections around the related behaviors and tools rather than the group name alone.
- Correlate web application exploitation indicators with subsequent web server child processes, new files in web directories, outbound connections, and credential access attempts.
- Tune for legitimate administration overlap: Net, ping, ipconfig, netstat, ftp, certutil, BITSAdmin, dsquery, Impacket, PowerSploit, Empire, and Cobalt Strike can have authorized or testing use, so detections should include context such as host role, account, timing, command line, destination, and change ticket evidence.
- Validate identity telemetry depth, especially for credential dumping signals and unusual Active Directory enumeration from non-administrative systems.
- Use relationship-driven hunt packs for web shells, credential dumping, remote access frameworks, and living-off-the-land utilities; avoid assuming all related software will appear in every incident.
Mitigation priorities
- Maintain an authoritative inventory of Internet-facing applications and prioritize remediation of exploitable web application vulnerabilities, especially newly disclosed issues affecting exposed systems.
- Harden and monitor web servers: restrict write paths, review uploaded files, collect logs centrally, and alert on unexpected script execution from web directories.
- Reduce credential theft blast radius through least privilege, privileged access controls, credential hygiene, and monitoring of high-risk authentication events.
- Control and audit administrative utilities and offensive security frameworks with allowlisting, script logging, EDR policy, and clear exception processes for authorized testing.
- Prepare IR playbooks that connect web compromise, web shell triage, credential reset scope, lateral movement review, and evidence preservation.
Additional notes and limits
The strongest business signal in the supplied ATT&CK data is the combination of broad sector targeting, dual espionage and financially motivated characterization, extensive tool relationships, and the C0017 campaign note about exploitation of vulnerable Internet-facing web applications. This should drive validation of exposure management, identity telemetry, and IR readiness rather than attribution-centric alerting.
ATT&CK does not provide official detection guidance, tactics, or platforms on the APT41 group object itself. Platform observations come only from related software objects, and campaign descriptions are not proof of current activity against any specific organization. Local asset exposure, logging maturity, authorized tool use, and threat intelligence are required to determine relevance and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.Citationapt41_mandiant Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.CitationFireEye APT41 Aug 2019CitationGroup IB APT 41 June 2021
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.