Threat Actor Characterization
APT41
ID: 4efd834e57e0b0527cb9b30cd331b8dc79736| Barium | Brass Typhoon | Br********** | Do*********** |
| Re******** | TG***** | Wi********** | Wi*********** |
| W***** | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
APT41 is a China-nexus intrusion set widely described as conducting state-aligned espionage in parallel with financially motivated cybercrime (“dual mission”). Public government and vendor reporting describe initial access via spearphishing, exploitation of public-facing applications, and supply chain compromise, followed by web shells, in-memory droppers/plugin frameworks, DLL side-loading persistence, and sustained data exfiltration (including cloud-assisted channels). APT41 operations often require a dual-lens analytic approach to distinguish espionage objectives from opportunistic monetization signals (ransomware/cryptojacking).
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.001 | Spearphishing Attachment | TA0001 |
|
| T1195.002 | Compromise Software Supply Chain | TA0001 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1505.003 | Web Shell | TA0003 |
|
| T1055 | Process Injection | TA0004 TA0005 |
|
| T1543.003 | Windows Service | TA0003 TA0004 |
|
| T1574.002 | DLL Side-Loading | TA0003 TA0004 TA0005 |
|
| T1074.001 | Local Data Staging | TA0009 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Actor type: Cyber / hybrid — China-nexus operator associated with both state-aligned espionage and financially motivated cybercrime (“dual mission”) in open reporting.
Primary motivation: Espionage with parallel criminal monetization (reported).
Common aliases: BARIUM, Winnti, Wicked Panda, Wicked Spider, Double Dragon, Brass Typhoon, TG-2633, Red Kelpie, Bronze Atlas.
Executive Summary
APT41 is widely described in public reporting as a prolific China-nexus intrusion set notable for conducting state-aligned espionage while also engaging in financially motivated activity. U.S. Department of Justice communications describe intrusions attributed to “APT41” labels and associated aliases that supported theft of source code and sensitive business information, while also enabling ransomware and cryptojacking schemes. Joint FBI/CISA reporting describes broad initial access methods including spearphishing and rapid exploitation of public-facing vulnerabilities, as well as supply chain compromises. Multiple public analyses emphasize APT41’s adaptability: from vulnerability exploitation and web-application compromise to in-memory droppers, web shells, and data exfiltration using common enterprise channels and cloud services.
OSINT frames APT41 as operating at the intersection of espionage and profit. This duality is a defining analytic feature: an operation’s victimology may look “state-like” even when monetization artifacts appear. INFERENCE (confidence: medium): the actor’s longevity and diversity of tooling suggest access to a broad shared arsenal and a mature internal R&D and operations pipeline, with parallel workflows for state-directed collection and opportunistic monetization.