S0141: Winnti for Windows
Winnti for Windows is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, Winnti Group.[1][2][3][4]. The Linux variant is tracked separately under Winnti for Linux.[5]
Security context for executives and security teams
S0141: Winnti for Windows describes [Winnti for Windows](https://attack.mitre.org/software/S0141) is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: Kaspersky Winnti April 2013)(Citation: Microsoft Winnti Jan 2017)(Citation: Novetta Winnti April 2015)(Citation: 401 TRG Winnti Umbrella May 2018). The Linux variant is tracked separately und...
Executive priority
S0141: Winnti for Windows is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0141: Winnti for Windows by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0141: Winnti for Windows appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Winnti for Windows
Winnti for Windows is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, Winnti Group.[1][2][3][4]. The Linux variant is tracked separately under Winnti for Linux.[5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1106 | Native API | Winnti for Windows can use Native API to create a new process and to start services.[3] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.[2] |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | Winnti for Windows can XOR encrypt C2 traffic.[3] |
| Enterprise | T1083 | File and Directory Discovery | Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.[3] |
| Enterprise | T1090.002 | External ProxySub-technique | The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.[3] |
| Enterprise | T1095 | Non-Application Layer Protocol | Winnti for Windows can communicate using custom TCP.[3] |
| Enterprise | T1057 | Process Discovery | Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.[3] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | Winnti for Windows can add a service named |
| Enterprise | T1090.001 | Internal ProxySub-technique | The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.[3] |
| Enterprise | T1218.011 | Rundll32Sub-technique | The Winnti for Windows installer loads a DLL using rundll32.[2][3] |
| Enterprise | T1548.002 | Bypass User Account ControlSub-technique | Winnti for Windows can use a variant of the sysprep UAC bypass.[3] |
| Enterprise | T1082 | System Information Discovery | Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.[3] |
| Enterprise | T1027.015 | CompressionSub-technique | Winnti for Windows has the ability to encrypt and compress its payload.[3] |
| Enterprise | T1569.002 | Service ExecutionSub-technique | Winnti for Windows can run as a service using svchost.exe.[3] |
| Enterprise | T1105 | Ingress Tool Transfer | The Winnti for Windows dropper can place malicious payloads on targeted systems.[3] |
| Enterprise | T1070.004 | File DeletionSub-technique | Winnti for Windows can delete the DLLs for its various components from a compromised host.[3] |
| Enterprise | T1070.006 | TimestompSub-technique | Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.[3] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | Winnti for Windows has the ability to encrypt and compress its payload.[3] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | The Winnti for Windows dropper can decrypt and decompresses a data blob.[3] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.[3] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.[2] |
| Enterprise | T1480.001 | Environmental KeyingSub-technique | The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.[3] |
Groups, software, and campaigns
G0143: Aquatic Panda
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.[1]
G0044: Winnti Group
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.[1][2][3] Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.[4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 3.1 | Current bundle | 04f2bab1c8be… | ||
| 19.1 | 3.1 | Older bundle | 04f2bab1c8be… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Kaspersky Winnti April 2013
Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
Open source URL - [2]Microsoft Winnti Jan 2017
Cap, P., et al. (2017, January 25). Detecting threat actors in recent German industrial attacks with Windows Defender ATP. Retrieved February 8, 2017.
Open source URL - [3]Novetta Winnti April 2015
Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
Open source URL - [4]401 TRG Winnti Umbrella May 2018
Hegel, T. (2018, May 3). Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers. Retrieved July 8, 2018.
Open source URL - [5]Chronicle Winnti for Linux May 2019
Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.
Open source URL - [6]mitre-attackS0141Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.