Overview 3,526 indicators
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.
| ipv4 | 2,784 | G0096.json |
| domain | 541 | G0096-domain.txt |
| url | 201 | G0096.json |
Techniques 82 ATT&CK
Open in ATT&CK Navigator → or download the layer (82 techniques, layer 4.5)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1005 Data from Local System
- T1008 Fallback Channels
- T1012 Query Registry
- T1014 Rootkit
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1037 Boot or Logon Initialization Scripts
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1069 Permission Groups Discovery
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.004 DNS
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1090 Proxy
- T1098.007 Additional Local or Domain Groups
- T1102.001 Dead Drop Resolver
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1112 Modify Registry
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1197 BITS Jobs
- T1203 Exploitation for Client Execution
- T1213.003 Code Repositories
- T1218.001 Compiled HTML File
- T1218.011 Rundll32
- T1480.001 Environmental Keying
- T1484.001 Group Policy Modification
- T1486 Data Encrypted for Impact
- T1496.001 Compute Hijacking
- T1542.003 Bootkit
- T1543.003 Windows Service
- T1546.008 Accessibility Features
- T1547.001 Registry Run Keys / Startup Folder
- T1550.002 Pass the Hash
- T1553.002 Code Signing
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1568.002 Domain Generation Algorithms
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1574.001 DLL
- T1574.006 Dynamic Linker Hijacking
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1595.003 Wordlist Scanning
- T1596.005 Scan Databases
- T1599 Network Boundary Bridging
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
Software 32
- Mimikatz
- pwdump
- PlugX
- China Chopper
- Derusbi
- gh0st RAT
- Net
- BLACKCOFFEE
- ASPXSpy
- ftp
- Ping
- ipconfig
- netstat
- dsquery
- ROCKBOOT
- Cobalt Strike
- certutil
- BITSAdmin
- PowerSploit
- sqlmap
- Impacket
- Empire
- njRAT
- ZxShell
- Winnti for Linux
- MESSAGETAP
- ShadowPad
- KEYPLUG
- DUSTPAN
- DUSTTRAP
- LightSpy
- MOPSLED
Principal sources 188 reports
Ranked by how many of this actor's indicators each report brought in.
- 759threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- 745threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2026-0…
- 205threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- 180threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- 158threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- 131threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- 108threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2024-0…
- 95hunt.io/blog/keyplug-infrastructure-tls-certifi…
Related groups 19
What the sources have in common — not a claim that these are the same actor. See the whole graph.
11 more in the relationship graph.
Timeline 3,526 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 3,526. Complete: G0096.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
sentinelone.com/labs/one-target-china-india-espionage-c… · virustotal.com/gui/ip-address/45.125.32.218/relations · virustotal.com/gui/file/4d7da83ed24320959b067e0ac9682f…
domain dns.dnserver.life domain dnserver.life domain erp.kaspersky.icu domain kaspersky.icu ipv4 45.125.32.218:443 -
app.validin.com/detail?type=hash&find=e760bb9ce1e83e274…
proxy-test.dynv6.net -
plausible-deniability.co/blog/PullingTheThread-ChineseEspionnage
domain 7f4d5b4d9b3b4474a46824c3ae43d06a.ddns.gcloud.gg domain api-v2.cloud domain cashmicrosoft.com domain googledrivecloud.com domain rallyracingglobal.com domain windowsupdate.cyou ipv4 103.140.186.81:443 ipv4 103.140.187.9:443 ipv4 104.238.148.158:443 ipv4 139.180.137.3:443 ipv4 139.180.211.117:443 ipv4 193.56.255.178:443 ipv4 195.86.120.2:443 ipv4 38.60.208.77:443 ipv4 38.60.255.134:443 ipv4 65.20.67.90:443 ipv4 65.20.76.151:443 ipv4 65.20.97.249:443 -
x.com/StrikeReadyLabs/status/1845881714607792… · x.com/AptXXhunter/status/2057431332041506967 · fortifiedhealthsecurity.com/threat-bulletin/lightspy-deepdata · virustotal.com/gui/file/92d71e5e265fd266036881767a8309…
103.27.108.207:8080 103.56.16.173:443 -
lookout.com/threat-intelligence/article/wyrmspy-dra… · virustotal.com/gui/file/38e18d79b83e7c0afbe1ac246a7a5f…
domain yxwasec.com ipv4 121.201.109.98:443 -
x.com/_CPResearch_/status/2028888546438766707 · research.checkpoint.com/2026/silver-dragon-targets-organization…
ampolice.org bigflx.net copilot-cloud.net drivefrontend.pa-clients.workers.dev exchange4study.com mindssurpass.com onedriveconsole.com protacik.com revitpourtous.com splunkds.com wikipedla.blog zhydromet.com -
threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2026-0…
domain app30.hema129.com domain app40.hema129.com domain bganmcza.top domain channels.openvista.ma domain cnt9.stayout.life domain commandidate.directory domain ec2-16-163-161-107.ap-east-1.compute.amazonaws.com domain fervent-curran.45-77-153-108.plesk.page domain gallant-pike.45-77-153-108.plesk.page domain grxcmoyh.top domain infallible-tereshkova.199-247-22-187.plesk.page domain ip-89-38-128-94-106854.vps.hosted-by-mvps.net domain jqvmwznu.top domain laodocument.com domain maxdesigns.top domain mgm4adminsi.com domain mhgxpcgd.top domain patch.updatesapi.com domain riwmztda.top domain smivsugd.top domain sv3.xxyybb.xyz domain wait.imiul.com domain xeaefryx.top domain xvaxzoac.top domain xxyybb.xyz ipv4 1.92.101.250:8000 ipv4 1.92.101.250:8001 ipv4 1.92.101.250:8002 ipv4 1.92.101.250:8003 ipv4 1.92.101.250:8004 ipv4 1.92.101.250:8005 ipv4 1.92.101.250:8006 ipv4 1.92.101.250:8007 ipv4 1.92.107.96:8000 ipv4 1.92.107.96:8001 ipv4 1.92.107.96:8002 ipv4 1.92.107.96:8003 ipv4 1.92.107.96:8004 ipv4 1.92.107.96:8005 ipv4 1.92.107.96:8006 ipv4 1.92.107.96:8007 ipv4 1.92.148.235:8000 ipv4 1.92.148.235:8001 ipv4 1.92.148.235:8002 ipv4 1.92.148.235:8003 ipv4 1.92.148.235:8004 ipv4 1.92.148.235:8005 ipv4 1.92.148.235:8006 ipv4 1.92.148.235:8007 ipv4 1.92.72.199:8000 ipv4 1.92.72.199:8001 ipv4 1.92.72.199:8002 ipv4 1.92.72.199:8003 ipv4 1.92.72.199:8004 ipv4 1.92.72.199:8005 ipv4 1.92.72.199:8006 ipv4 1.92.72.199:8007 ipv4 1.92.98.22:8000 ipv4 1.92.98.22:8001 ipv4 1.92.98.22:8002 ipv4 1.92.98.22:8003 ipv4 1.92.98.22:8004 ipv4 1.92.98.22:8005 ipv4 1.92.98.22:8006 ipv4 1.92.98.22:8007 ipv4 1.94.101.136:8000 ipv4 1.94.101.136:8002 ipv4 1.94.101.136:8003 ipv4 1.94.101.136:8004 ipv4 1.94.101.136:8005 ipv4 1.94.101.136:8006 ipv4 1.94.101.136:8007 ipv4 1.94.125.147:8000 ipv4 1.94.125.147:8001 ipv4 1.94.125.147:8002 ipv4 1.94.125.147:8003 ipv4 1.94.125.147:8004 ipv4 1.94.125.147:8005 ipv4 1.94.125.147:8006 ipv4 1.94.125.147:8007 ipv4 1.94.137.47:8000 ipv4 1.94.137.47:8001 ipv4 1.94.137.47:8002 ipv4 1.94.137.47:8003 ipv4 1.94.137.47:8004 ipv4 1.94.137.47:8005 ipv4 1.94.137.47:8006 ipv4 1.94.137.47:8007 ipv4 1.94.2.18:8000 ipv4 1.94.2.18:8001 ipv4 1.94.2.18:8002 ipv4 1.94.2.18:8003 ipv4 1.94.2.18:8004 ipv4 1.94.2.18:8005 ipv4 1.94.2.18:8006 ipv4 1.94.2.18:8007 ipv4 1.94.30.121:8000 ipv4 1.94.30.121:8001 ipv4 1.94.30.121:8002 ipv4 1.94.30.121:8003 ipv4 1.94.30.121:8004 ipv4 1.94.30.121:8005 ipv4 1.94.30.121:8006 ipv4 1.94.30.121:8007 ipv4 1.94.96.137:8000 ipv4 1.94.96.137:8001 ipv4 1.94.96.137:8002 ipv4 1.94.96.137:8003 ipv4 1.94.96.137:8004 ipv4 1.94.96.137:8005 ipv4 1.94.96.137:8007 ipv4 103.27.111.247:443 ipv4 103.82.143.13:56891 ipv4 103.85.252.170:443 ipv4 104.167.16.95:8080 ipv4 108.181.121.150:8083 ipv4 110.41.14.216:8000 ipv4 110.41.14.216:8001 ipv4 110.41.14.216:8002 ipv4 110.41.14.216:8003 ipv4 110.41.14.216:8004 ipv4 110.41.14.216:8005 ipv4 110.41.14.216:8006 ipv4 110.41.14.216:8007 ipv4 110.41.169.151:8000 ipv4 110.41.169.151:8001 ipv4 110.41.169.151:8002 ipv4 110.41.169.151:8003 ipv4 110.41.169.151:8004 ipv4 110.41.169.151:8005 ipv4 110.41.169.151:8006 ipv4 110.41.169.151:8007 ipv4 110.41.22.9:8000 ipv4 110.41.22.9:8001 ipv4 110.41.22.9:8002 ipv4 110.41.22.9:8003 ipv4 110.41.22.9:8004 ipv4 110.41.22.9:8005 ipv4 110.41.22.9:8006 ipv4 110.41.22.9:8007 ipv4 110.41.56.186:8000 ipv4 110.41.56.186:8001 ipv4 110.41.56.186:8002 ipv4 110.41.56.186:8003 ipv4 110.41.56.186:8004 ipv4 110.41.56.186:8005 ipv4 110.41.56.186:8006 ipv4 110.41.56.186:8007 ipv4 110.41.63.167:8000 ipv4 110.41.63.167:8001 ipv4 110.41.63.167:8002 ipv4 110.41.63.167:8003 ipv4 110.41.63.167:8004 ipv4 110.41.63.167:8005 ipv4 110.41.63.167:8006 ipv4 110.41.63.167:8007 ipv4 112.26.72.6:8002 ipv4 112.27.239.72:8002 ipv4 112.27.239.72:8012 ipv4 112.27.239.72:8032 ipv4 112.30.118.6:8002 ipv4 117.133.132.134:8002 ipv4 117.133.132.135:8002 ipv4 117.48.148.58:6951 ipv4 119.3.251.25:8000 ipv4 119.3.251.25:8001 ipv4 119.3.251.25:8002 ipv4 119.3.251.25:8003 ipv4 119.3.251.25:8004 ipv4 119.3.251.25:8005 ipv4 119.3.251.25:8006 ipv4 119.3.251.25:8007 ipv4 120.46.221.103:8000 ipv4 120.46.221.103:8001 ipv4 120.46.221.103:8002 ipv4 120.46.221.103:8003 ipv4 120.46.221.103:8004 ipv4 120.46.221.103:8005 ipv4 120.46.221.103:8006 ipv4 120.46.221.103:8007 ipv4 120.46.76.213:8000 ipv4 120.46.76.213:8001 ipv4 120.46.76.213:8002 ipv4 120.46.76.213:8003 ipv4 120.46.76.213:8004 ipv4 120.46.76.213:8005 ipv4 120.46.76.213:8006 ipv4 120.46.76.213:8007 ipv4 120.46.93.223:8000 ipv4 120.46.93.223:8001 ipv4 120.46.93.223:8002 ipv4 120.46.93.223:8003 ipv4 120.46.93.223:8004 ipv4 120.46.93.223:8005 ipv4 120.46.93.223:8006 ipv4 120.46.93.223:8007 ipv4 121.36.196.101:8000 ipv4 121.36.196.101:8001 ipv4 121.36.196.101:8002 ipv4 121.36.196.101:8003 ipv4 121.36.196.101:8005 ipv4 121.36.196.101:8006 ipv4 121.36.196.101:8007 ipv4 121.37.172.191:8000 ipv4 121.37.172.191:8001 ipv4 121.37.172.191:8002 ipv4 121.37.172.191:8003 ipv4 121.37.172.191:8004 ipv4 121.37.172.191:8005 ipv4 121.37.172.191:8006 ipv4 121.37.172.191:8007 ipv4 121.37.184.225:8000 ipv4 121.37.184.225:8001 ipv4 121.37.184.225:8002 ipv4 121.37.184.225:8003 ipv4 121.37.184.225:8004 ipv4 121.37.184.225:8005 ipv4 121.37.184.225:8006 ipv4 121.37.184.225:8007 ipv4 121.37.241.33:8000 ipv4 121.37.241.33:8001 ipv4 121.37.241.33:8002 ipv4 121.37.241.33:8003 ipv4 121.37.241.33:8004 ipv4 121.37.241.33:8005 ipv4 121.37.241.33:8006 ipv4 121.37.241.33:8007 ipv4 121.37.42.92:8000 ipv4 121.37.42.92:8001 ipv4 121.37.42.92:8002 ipv4 121.37.42.92:8003 ipv4 121.37.42.92:8004 ipv4 121.37.42.92:8005 ipv4 121.37.42.92:8006 ipv4 121.37.42.92:8007 ipv4 121.9.235.74:38002 ipv4 123.249.11.137:8000 ipv4 123.249.11.137:8001 ipv4 123.249.11.137:8002 ipv4 123.249.11.137:8003 ipv4 123.249.11.137:8004 ipv4 123.249.11.137:8005 ipv4 123.249.11.137:8006 ipv4 123.249.11.137:8007 ipv4 123.249.83.110:8000 ipv4 123.249.83.110:8001 ipv4 123.249.83.110:8002 ipv4 123.249.83.110:8003 ipv4 123.249.83.110:8004 ipv4 123.249.83.110:8005 ipv4 123.249.83.110:8006 ipv4 123.249.83.110:8007 ipv4 123.60.109.41:8000 ipv4 123.60.109.41:8001 ipv4 123.60.109.41:8002 ipv4 123.60.109.41:8003 ipv4 123.60.109.41:8004 ipv4 123.60.109.41:8005 ipv4 123.60.109.41:8006 ipv4 123.60.109.41:8007 · 485 more in this batch, in the JSON
Further reading 193
- attack.mitre.org/groups/G0096
- go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdSt…
- learn.microsoft.com/en-us/microsoft-365/security/intelligen…
- group-ib.com/blog/colunmtk-apt41
- mandiant.com/sites/default/files/2022-02/rt-apt41-du…
- virustotal.com/gui/ip-address/64.176.69.95/relations
- github.com/Cisco-Talos/IOCs/blob/main/2026/02/knif…
- virustotal.com/gui/ip-address/136.244.116.245/relations
- x.com/Huntio/status/1824654200955080733
- x.com/Cyberteam008/status/1858703453981450712
- virustotal.com/gui/file/0ba468400dd88b6dbe96407cb104f2…
- threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2024-0…
- cloud.google.com/blog/topics/threat-intelligence/apt41-i…
- threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2023-1…
- virustotal.com/gui/file/f16faa26f8871692c49c5bc4a047b3…
- threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2024-0…
- virustotal.com/gui/ip-address/82.118.21.230/relations
- elastic.co/security-labs/introducing-the-ref5961-i…
- virustotal.com/gui/file/b2d2380ec8001acfacbba10305c5dd…
- fireeye.com/blog/threat-research/2020/03/apt41-init…
- virustotal.com/gui/file/1d40ac126547b1523a3fb7d584deec…
- stairwell.com/resources/security-alert-enrichment-sha…
- virustotal.com/gui/ip-address/139.84.133.219/relations
- virustotal.com/gui/file/f8fa90be3e6295c275a4d23429e873…
- x.com/Cyberteam008/status/1861596387625890122
- x.com/Cyberteam008/status/1826433189012730325
- twitter.com/luc4m/status/1778110699870310840
- otx.alienvault.com/pulse/630615f326d4b91e473170fe
- virustotal.com/gui/ip-address/62.233.57.94/relations
- twitter.com/1ZRR4H/status/1783528366194196585
- x.com/StrikeReadyLabs/status/1819460764517683…
- twitter.com/tiresearch1/status/1688843159265325056
- trendmicro.com/content/dam/trendmicro/global/en/resear…
- otx.alienvault.com/pulse/610cf675620c3a10851e62d0
- threatfox.abuse.ch/browse/malware/win.shadowpad/ (# 2024-0…
- x.com/nao_sec/status/1826977609328325111
- x.com/Cyberteam008/status/1910171025137934629
- blogs.blackberry.com/en/2021/10/drawing-a-dragon-connecting-…
- x.com/nahamike01/status/2020407834119487677
153 more, and the report behind every indicator, in G0096.json.