threat actor · China
APT41
11 CVEs exploited (10 in CISA KEV) · 82 techniques · 32 software
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open APT41's actor pageAPT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.
Source: MITRE ATT&CK, G0096. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
- Also known as
- TA415, Blackfly, Grayfly, LEAD, BARIUM, WICKED SPIDER, Wicked Panda, BRONZE ATLAS, BRONZE EXPORT, Red Kelpie, Earth Baku, Amoeba, HOODOO, Brass Typhoon, Winnti, Double Dragon, TG-2633, Leopard Typhoon, SPIRE CASTLE, TG-3279, Mana, KAOS, Red Diablo, Winnti Group
- Origin
- China
- Suspected sponsor
- People's Republic of China
- Kind
- state
- MITRE ATT&CK
- G0096
- On record in
- CyberSIXT · ATT&CK G0096 · MISP Galaxy
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.