Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT41. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (41)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• attack.mitre.orghttps://attack.mitre.org/groups/G0096
• go.crowdstrike.comhttps://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• group-ib.comhttps://www.group-ib.com/blog/colunmtk-apt41/
• mandiant.comhttps://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
• symantec.comhttp://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates
• 401trg.github.iohttps://401trg.github.io/pages/burning-umbrella.html
• attack.mitre.orghttps://attack.mitre.org/groups/G0044
• securelist.comhttps://securelist.com/games-are-over/70991/
• securelist.comhttps://securelist.com/winnti-more-than-just-a-game/37029/
• web.archive.orghttps://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf
• securelist.comhttps://securelist.com/winnti-faq-more-than-just-a-game/57585/
• williamshowalter.comhttp://williamshowalter.com/a-universal-windows-bootkit/
• microsoft.comhttps://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
• medium.comhttps://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
• dw.comhttps://www.dw.com/en/thyssenkrupp-victim-of-cyber-attack/a-36695341
• bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/teamviewer-confirms-undisclosed-breach-from-2016/
• blog.trendmicro.comhttps://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/
• dw.comhttps://www.dw.com/en/bayer-points-finger-at-wicked-panda-in-cyberattack/a-48196004
• welivesecurity.comhttps://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/
• 401trg.comhttps://401trg.com/burning-umbrella/
• attack.mitre.orghttps://attack.mitre.org/groups/G0044/
• crowdstrike.comhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/bronze-atlas
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/bronze-export
• pwc.co.ukhttps://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf
• justice.govhttps://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer
• assets.documentcloud.orghttps://assets.documentcloud.org/documents/7210602/FLASH-AC-000133-TT-Published.pdf
• cfr.orghttps://www.cfr.org/cyber-operations/winnti-umbrella
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/
• mandiant.comhttps://www.mandiant.com/resources/report-apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation
• cfr.orghttps://www.cfr.org/cyber-operations/apt-41
• uscc.govhttps://www.uscc.gov/sites/default/files/2022-02/Adam_Kozy_Testimony.pdf
• pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
• pwc.co.ukhttps://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
• fireeye.comhttps://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf
• welivesecurity.comhttps://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/
• services.google.comhttps://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
• trendmicro.comhttps://www.trendmicro.com/en_us/research/24/d/earth-freybug.html
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/