APT41
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 38 incidents
- Sources
- 11 sources
- First seen
- 2015-01-25
- Last seen
- 2023-12-13
- Updated
- 2026-10-14 19:31
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
BARIUM, also known as APT41 and Wicked Panda, is a China‑based threat actor described as a Chinese state‑sponsored group that conducts financially motivated and espionage‑oriented operations. It has compromised technology firms such as MongoDB and the payment processor LoopPay, manufacturers including Kendrion Kuhnke, BRP Inc. and an Asian mobile hardware/software producer, cryptocurrency exchanges like the unnamed Japanese exchange and Hotbit, educational institutions ranging from Wichita State University to Hong Kong universities, and government targets including US COVID‑relief funds, Douglas County, Prague public administration and the Mongolian government chat app Able Desktop. Observed TTPs involve the JokerSpy macOS backdoor with its xcc binary and Swiftbelt enumeration tool, the Winnti malware family (ShadowPad, PlugX, Poison Ivy, Cobalt Strike), and the modular PortReuse network implant; initial access has been gained via backdoored development tools (IntelliJ IDEA, iTerm, Visual Studio Code), phishing emails with malicious links, supply‑chain compromises of legitimate update mechanisms, and exploitation of Microsoft Exchange vulnerabilities. The group’s tooling shows multi‑architecture binaries, living‑off‑the‑land use of open‑source utilities, self‑signed masquerading as legitimate macOS processes, TCC database manipulation, and modular backdoors that inject into listening network ports.
Incidents
Attributed incidents are available to members.
38 incidentsSources
Sources available to members: 11 sources.