apt41-double-dragon

• SKILL.mdcore · 20,859 bytes
• SKILL.mdcore · 20,859 bytes

# APT41 (Double Dragon, Wicked Panda, BARIUM) — Adversary Emulation Profile

APT41 (MITRE ATT&CK **G0096**; also tracked as Double Dragon, Wicked Panda, Winnti, BARIUM, and Microsoft's **Brass Typhoon**) is a prolific Chinese threat actor unique for running **state-sponsored cyber-espionage in parallel with financially motivated cybercrime** — often reusing the same non-public malware for both missions. First publicly profiled by FireEye/Mandiant in August 2019, the group has been active since at least 2012, beginning in the video-game economy (virtual-currency theft, ransomware, code-signing certificate theft) and expanding into wide-ranging espionage. APT41 is best known for **software supply-chain compromises** (poisoning legitimately signed installers), rapid weaponization of newly disclosed vulnerabilities, abuse of **stolen code-signing certificates**, and a deep, modular toolset spanning Windows and Linux. This profile maps APT41's documented TTPs to ATT&CK so Decepticon can emulate them under authorized scope and the blue cell can anticipate detection.

## Attribution & motivation

- **Suspected sponsor / nation:** People's Republic of China. Mandiant assesses APT41 operates under the **MSS (Ministry of State Security) contractor model** — nominally private companies executing intelligence taskings for provincial MSS bureaus — rather than the PLA model. The group is operationally linked to the Chengdu-based front company **Chengdu 404 Network Technology Co., Ltd.**
- **Motivation:** **Dual-mandate.** Espionage (intellectual property, strategic intelligence, surveillance of dissidents/pro-democracy figures) interleaved with **financial gain** (game virtual-currency manipulation, ransomware, cryptomining). Mandiant observed espionage during Beijing business hours and financially motivated activity during off-hours, suggesting moonlighting on shared infrastructure.
- **Confidence:** **High** for China nexus and dual motivation. The U.S. DOJ on **September 16, 2020** indicted five Chinese nationals (Zhang Haoran, Tan Dailin, Jiang Lizhi, Qian Chuan, Fu Qiang) and two Malaysian accomplices (Wong Ong Hua, Ling Yang Ching) in connection with attacks on 100+ victims globally, lending strong public attribution. Specific operation-to-operator mapping within individual intrusions carries lower confidence.

## Targeting

- **Sectors:** Video games & game publishers, software/IT and computer hardware, telecommunications (incl. call-record interception), healthcare & pharmaceuticals, high-tech/semiconductors, media & entertainment, shipping & logistics, automotive, financial services, education, think tanks, and government.
- **Regions:** Global — North America, Europe (Italy, Spain, UK), East and Southeast Asia (Taiwan, Thailand, Hong Kong, Japan, South Korea), the Middle East (Turkey), and beyond. U.S. **state governments** were a notable target.