← All actors Recent activity

APT41 G0096

BARIUM · WICKEDPANDA · AXIOMATICASYMPTOTE · RedEcho · apt-c-41 · apt41 · bamboloader · double dragon · eagerbee · earth baku · earth baxia · geardoor · lowkey · monikerloader · shadowhammer · shadowpad · silver dragon · silverscreen · sshcmd · ta415 · toughprogress · voldemort · xianggang

Indicators
3,526
Source reports
188
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-07-10
20172026

Overview 3,526 indicators

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.

ipv42,784G0096.json
domain541G0096-domain.txt
url201G0096.json

Techniques 82 ATT&CK

Open in ATT&CK Navigator → or download the layer (82 techniques, layer 4.5)

Software 32

Principal sources 188 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

11 more in the relationship graph.

Timeline 3,526 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 3,526. Complete: G0096.json.

  1. 4 domain, 1 ipv4this year

    sentinelone.com/labs/one-target-china-india-espionage-c… · virustotal.com/gui/ip-address/45.125.32.218/relations · virustotal.com/gui/file/4d7da83ed24320959b067e0ac9682f…

    domaindns.dnserver.life
    domaindnserver.life
    domainerp.kaspersky.icu
    domainkaspersky.icu
    ipv445.125.32.218:443

  2. 1 domainthis year

    app.validin.com/detail?type=hash&find=e760bb9ce1e83e274…

    proxy-test.dynv6.net

  3. 6 domain, 12 ipv4this year

    plausible-deniability.co/blog/PullingTheThread-ChineseEspionnage

    domain7f4d5b4d9b3b4474a46824c3ae43d06a.ddns.gcloud.gg
    domainapi-v2.cloud
    domaincashmicrosoft.com
    domaingoogledrivecloud.com
    domainrallyracingglobal.com
    domainwindowsupdate.cyou
    ipv4103.140.186.81:443
    ipv4103.140.187.9:443
    ipv4104.238.148.158:443
    ipv4139.180.137.3:443
    ipv4139.180.211.117:443
    ipv4193.56.255.178:443
    ipv4195.86.120.2:443
    ipv438.60.208.77:443
    ipv438.60.255.134:443
    ipv465.20.67.90:443
    ipv465.20.76.151:443
    ipv465.20.97.249:443

  4. 2 ipv4this year

    x.com/StrikeReadyLabs/status/1845881714607792… · x.com/AptXXhunter/status/2057431332041506967 · fortifiedhealthsecurity.com/threat-bulletin/lightspy-deepdata · virustotal.com/gui/file/92d71e5e265fd266036881767a8309…

    103.27.108.207:8080
    103.56.16.173:443

  5. 1 domain, 1 ipv4this year

    lookout.com/threat-intelligence/article/wyrmspy-dra… · virustotal.com/gui/file/38e18d79b83e7c0afbe1ac246a7a5f…

    domainyxwasec.com
    ipv4121.201.109.98:443

  6. 12 domainthis year

    x.com/_CPResearch_/status/2028888546438766707 · research.checkpoint.com/2026/silver-dragon-targets-organization…

    ampolice.org
    bigflx.net
    copilot-cloud.net
    drivefrontend.pa-clients.workers.dev
    exchange4study.com
    mindssurpass.com
    onedriveconsole.com
    protacik.com
    revitpourtous.com
    splunkds.com
    wikipedla.blog
    zhydromet.com

  7. 25 domain, 706 ipv4, 14 urlthis year

    threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2026-0…

    domainapp30.hema129.com
    domainapp40.hema129.com
    domainbganmcza.top
    domainchannels.openvista.ma
    domaincnt9.stayout.life
    domaincommandidate.directory
    domainec2-16-163-161-107.ap-east-1.compute.amazonaws.com
    domainfervent-curran.45-77-153-108.plesk.page
    domaingallant-pike.45-77-153-108.plesk.page
    domaingrxcmoyh.top
    domaininfallible-tereshkova.199-247-22-187.plesk.page
    domainip-89-38-128-94-106854.vps.hosted-by-mvps.net
    domainjqvmwznu.top
    domainlaodocument.com
    domainmaxdesigns.top
    domainmgm4adminsi.com
    domainmhgxpcgd.top
    domainpatch.updatesapi.com
    domainriwmztda.top
    domainsmivsugd.top
    domainsv3.xxyybb.xyz
    domainwait.imiul.com
    domainxeaefryx.top
    domainxvaxzoac.top
    domainxxyybb.xyz
    ipv41.92.101.250:8000
    ipv41.92.101.250:8001
    ipv41.92.101.250:8002
    ipv41.92.101.250:8003
    ipv41.92.101.250:8004
    ipv41.92.101.250:8005
    ipv41.92.101.250:8006
    ipv41.92.101.250:8007
    ipv41.92.107.96:8000
    ipv41.92.107.96:8001
    ipv41.92.107.96:8002
    ipv41.92.107.96:8003
    ipv41.92.107.96:8004
    ipv41.92.107.96:8005
    ipv41.92.107.96:8006
    ipv41.92.107.96:8007
    ipv41.92.148.235:8000
    ipv41.92.148.235:8001
    ipv41.92.148.235:8002
    ipv41.92.148.235:8003
    ipv41.92.148.235:8004
    ipv41.92.148.235:8005
    ipv41.92.148.235:8006
    ipv41.92.148.235:8007
    ipv41.92.72.199:8000
    ipv41.92.72.199:8001
    ipv41.92.72.199:8002
    ipv41.92.72.199:8003
    ipv41.92.72.199:8004
    ipv41.92.72.199:8005
    ipv41.92.72.199:8006
    ipv41.92.72.199:8007
    ipv41.92.98.22:8000
    ipv41.92.98.22:8001
    ipv41.92.98.22:8002
    ipv41.92.98.22:8003
    ipv41.92.98.22:8004
    ipv41.92.98.22:8005
    ipv41.92.98.22:8006
    ipv41.92.98.22:8007
    ipv41.94.101.136:8000
    ipv41.94.101.136:8002
    ipv41.94.101.136:8003
    ipv41.94.101.136:8004
    ipv41.94.101.136:8005
    ipv41.94.101.136:8006
    ipv41.94.101.136:8007
    ipv41.94.125.147:8000
    ipv41.94.125.147:8001
    ipv41.94.125.147:8002
    ipv41.94.125.147:8003
    ipv41.94.125.147:8004
    ipv41.94.125.147:8005
    ipv41.94.125.147:8006
    ipv41.94.125.147:8007
    ipv41.94.137.47:8000
    ipv41.94.137.47:8001
    ipv41.94.137.47:8002
    ipv41.94.137.47:8003
    ipv41.94.137.47:8004
    ipv41.94.137.47:8005
    ipv41.94.137.47:8006
    ipv41.94.137.47:8007
    ipv41.94.2.18:8000
    ipv41.94.2.18:8001
    ipv41.94.2.18:8002
    ipv41.94.2.18:8003
    ipv41.94.2.18:8004
    ipv41.94.2.18:8005
    ipv41.94.2.18:8006
    ipv41.94.2.18:8007
    ipv41.94.30.121:8000
    ipv41.94.30.121:8001
    ipv41.94.30.121:8002
    ipv41.94.30.121:8003
    ipv41.94.30.121:8004
    ipv41.94.30.121:8005
    ipv41.94.30.121:8006
    ipv41.94.30.121:8007
    ipv41.94.96.137:8000
    ipv41.94.96.137:8001
    ipv41.94.96.137:8002
    ipv41.94.96.137:8003
    ipv41.94.96.137:8004
    ipv41.94.96.137:8005
    ipv41.94.96.137:8007
    ipv4103.27.111.247:443
    ipv4103.82.143.13:56891
    ipv4103.85.252.170:443
    ipv4104.167.16.95:8080
    ipv4108.181.121.150:8083
    ipv4110.41.14.216:8000
    ipv4110.41.14.216:8001
    ipv4110.41.14.216:8002
    ipv4110.41.14.216:8003
    ipv4110.41.14.216:8004
    ipv4110.41.14.216:8005
    ipv4110.41.14.216:8006
    ipv4110.41.14.216:8007
    ipv4110.41.169.151:8000
    ipv4110.41.169.151:8001
    ipv4110.41.169.151:8002
    ipv4110.41.169.151:8003
    ipv4110.41.169.151:8004
    ipv4110.41.169.151:8005
    ipv4110.41.169.151:8006
    ipv4110.41.169.151:8007
    ipv4110.41.22.9:8000
    ipv4110.41.22.9:8001
    ipv4110.41.22.9:8002
    ipv4110.41.22.9:8003
    ipv4110.41.22.9:8004
    ipv4110.41.22.9:8005
    ipv4110.41.22.9:8006
    ipv4110.41.22.9:8007
    ipv4110.41.56.186:8000
    ipv4110.41.56.186:8001
    ipv4110.41.56.186:8002
    ipv4110.41.56.186:8003
    ipv4110.41.56.186:8004
    ipv4110.41.56.186:8005
    ipv4110.41.56.186:8006
    ipv4110.41.56.186:8007
    ipv4110.41.63.167:8000
    ipv4110.41.63.167:8001
    ipv4110.41.63.167:8002
    ipv4110.41.63.167:8003
    ipv4110.41.63.167:8004
    ipv4110.41.63.167:8005
    ipv4110.41.63.167:8006
    ipv4110.41.63.167:8007
    ipv4112.26.72.6:8002
    ipv4112.27.239.72:8002
    ipv4112.27.239.72:8012
    ipv4112.27.239.72:8032
    ipv4112.30.118.6:8002
    ipv4117.133.132.134:8002
    ipv4117.133.132.135:8002
    ipv4117.48.148.58:6951
    ipv4119.3.251.25:8000
    ipv4119.3.251.25:8001
    ipv4119.3.251.25:8002
    ipv4119.3.251.25:8003
    ipv4119.3.251.25:8004
    ipv4119.3.251.25:8005
    ipv4119.3.251.25:8006
    ipv4119.3.251.25:8007
    ipv4120.46.221.103:8000
    ipv4120.46.221.103:8001
    ipv4120.46.221.103:8002
    ipv4120.46.221.103:8003
    ipv4120.46.221.103:8004
    ipv4120.46.221.103:8005
    ipv4120.46.221.103:8006
    ipv4120.46.221.103:8007
    ipv4120.46.76.213:8000
    ipv4120.46.76.213:8001
    ipv4120.46.76.213:8002
    ipv4120.46.76.213:8003
    ipv4120.46.76.213:8004
    ipv4120.46.76.213:8005
    ipv4120.46.76.213:8006
    ipv4120.46.76.213:8007
    ipv4120.46.93.223:8000
    ipv4120.46.93.223:8001
    ipv4120.46.93.223:8002
    ipv4120.46.93.223:8003
    ipv4120.46.93.223:8004
    ipv4120.46.93.223:8005
    ipv4120.46.93.223:8006
    ipv4120.46.93.223:8007
    ipv4121.36.196.101:8000
    ipv4121.36.196.101:8001
    ipv4121.36.196.101:8002
    ipv4121.36.196.101:8003
    ipv4121.36.196.101:8005
    ipv4121.36.196.101:8006
    ipv4121.36.196.101:8007
    ipv4121.37.172.191:8000
    ipv4121.37.172.191:8001
    ipv4121.37.172.191:8002
    ipv4121.37.172.191:8003
    ipv4121.37.172.191:8004
    ipv4121.37.172.191:8005
    ipv4121.37.172.191:8006
    ipv4121.37.172.191:8007
    ipv4121.37.184.225:8000
    ipv4121.37.184.225:8001
    ipv4121.37.184.225:8002
    ipv4121.37.184.225:8003
    ipv4121.37.184.225:8004
    ipv4121.37.184.225:8005
    ipv4121.37.184.225:8006
    ipv4121.37.184.225:8007
    ipv4121.37.241.33:8000
    ipv4121.37.241.33:8001
    ipv4121.37.241.33:8002
    ipv4121.37.241.33:8003
    ipv4121.37.241.33:8004
    ipv4121.37.241.33:8005
    ipv4121.37.241.33:8006
    ipv4121.37.241.33:8007
    ipv4121.37.42.92:8000
    ipv4121.37.42.92:8001
    ipv4121.37.42.92:8002
    ipv4121.37.42.92:8003
    ipv4121.37.42.92:8004
    ipv4121.37.42.92:8005
    ipv4121.37.42.92:8006
    ipv4121.37.42.92:8007
    ipv4121.9.235.74:38002
    ipv4123.249.11.137:8000
    ipv4123.249.11.137:8001
    ipv4123.249.11.137:8002
    ipv4123.249.11.137:8003
    ipv4123.249.11.137:8004
    ipv4123.249.11.137:8005
    ipv4123.249.11.137:8006
    ipv4123.249.11.137:8007
    ipv4123.249.83.110:8000
    ipv4123.249.83.110:8001
    ipv4123.249.83.110:8002
    ipv4123.249.83.110:8003
    ipv4123.249.83.110:8004
    ipv4123.249.83.110:8005
    ipv4123.249.83.110:8006
    ipv4123.249.83.110:8007
    ipv4123.60.109.41:8000
    ipv4123.60.109.41:8001
    ipv4123.60.109.41:8002
    ipv4123.60.109.41:8003
    ipv4123.60.109.41:8004
    ipv4123.60.109.41:8005
    ipv4123.60.109.41:8006
    ipv4123.60.109.41:8007

    · 485 more in this batch, in the JSON

Further reading 193

153 more, and the report behind every indicator, in G0096.json.