Threat actor · all actors

Winnti GroupG0044 state

aka Winnti Group, Blackfly, APT41, G0096, TA415, Grayfly, LEAD, BARIUM, WICKED SPIDER, WICKED PANDA, BRONZE ATLAS, BRONZE EXPORT, Red Kelpie, G0044, Earth Baku, Amoeba, HOODOO, Brass Typhoon, Winnti, Double Dragon, TG-2633, Leopard Typhoon, SPIRE CASTLE

Last updated: 2026-10-16

32attributed CVEs

8ATT&CK techniques

73.5IDF score (tooling uniqueness)

0exclusive CVEs

2012–2024years active

About this actor

[Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including [Axiom](https://attack.mitre.org/groups/G0001), [APT17](https://attack.mitre.org/groups/G0025), and [Ke3chang](https://attack.mitre.org/groups/G0004), are closely linked to [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: 401 TRG Winnti Umbrella May 2018)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0044G0096

Microsoftweather-system names

Brass TyphoonLeopard Typhoon

CrowdStrikenation-animal names

WICKED SPIDERWICKED PANDADouble Dragon

Mandiant / genericAPT numbering

APT41

Secureworkscolour-metal names

BRONZE ATLASBRONZE EXPORT

ProofpointTA threat-actor id

TA415

Unclassifiedno scheme matched

Winnti GroupBlackflyGrayflyLEADBARIUMRed KelpieEarth BakuAmoebaHOODOOWinntiTG-2633SPIRE CASTLE

How we know this

Data origin: MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques: MITRE ATT&CK STIX mappings — 8 ATT&CK techniques on file.
Named victims: None on file.

See how actor data is built for the full pipeline.

Activity timeline

CVE publishedKEV added

2024 — 1 KEV added
2022 — 2 KEV added
2021 — 1 CVE published, 27 KEV added
2020 — 14 CVE published
2019 — 11 CVE published
2018 — 2 CVE published
2017 — 2 CVE published
2015 — 1 CVE published
2012 — 1 CVE published

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2019-11510` KEV	10.0	10.0	1.0000	2019-05-08	see CVE
`CVE-2020-1350` KEV	10.0	10.0	0.9672	2020-07-14	see CVE
`CVE-2015-4852` KEV	9.9	9.8	0.9688	2015-11-18	see CVE
`CVE-2018-4939` KEV	9.9	9.8	0.9732	2018-05-19	see CVE
`CVE-2018-6789` KEV	9.9	9.8	0.9748	2018-02-08	see CVE
`CVE-2019-0708` KEV	9.9	9.8	1.0000	2019-05-16	see CVE
`CVE-2019-11580` KEV	9.9	9.8	0.9750	2019-06-03	see CVE
`CVE-2019-16278` KEV	9.9	9.8	0.9906	2019-10-14	see CVE
`CVE-2019-16920` KEV	9.9	9.8	1.0000	2019-09-27	see CVE
`CVE-2019-18935` KEV	9.9	9.8	0.9974	2019-12-11	see CVE
`CVE-2019-19781` KEV	9.9	9.8	1.0000	2019-12-27	see CVE
`CVE-2019-3396` KEV	9.9	9.8	0.9991	2019-03-25	see CVE
`CVE-2020-10189` KEV	9.9	9.8	0.9994	2020-03-06	see CVE
`CVE-2020-15505` KEV	9.9	9.8	0.9974	2020-07-07	see CVE
`CVE-2020-2555` KEV	9.9	9.8	0.9712	2020-01-15	see CVE
`CVE-2020-5902` KEV	9.9	9.8	1.0000	2020-07-01	see CVE
`CVE-2020-8515` KEV	9.9	9.8	0.9999	2020-02-01	see CVE
`CVE-2012-0158` KEV	9.2	8.8	0.9999	2012-04-10	see CVE
`CVE-2017-6327` KEV	9.2	8.8	0.7818	2017-08-11	see CVE
`CVE-2020-0688` KEV	9.2	8.8	0.9997	2020-02-11	see CVE
`CVE-2020-3118` KEV	9.2	8.8	0.1181	2020-02-05	see CVE
`CVE-2020-1040` KEV	9.0	9.0	0.0739	2020-07-14	see CVE
`CVE-2020-0601` KEV	8.7	8.1	0.9733	2020-01-14	see CVE
`CVE-2019-0803` KEV	8.5	7.8	0.9036	2019-04-09	see CVE
`CVE-2019-1653` KEV	8.5	7.5	0.9988	2019-01-24	see CVE
`CVE-2019-1652` KEV	8.1	7.2	0.9747	2019-01-24	see CVE
`CVE-2020-8193` KEV	7.8	6.5	0.9746	2020-07-10	see CVE
`CVE-2020-8195` KEV	7.7	6.5	0.9585	2020-07-10	see CVE
`CVE-2020-1472` KEV	7.5	5.5	0.9951	2020-08-17	see CVE
`CVE-2020-8196` KEV	7.5	4.3	0.7066	2020-07-10	see CVE
`CVE-2017-6328`	6.9	8.8	0.0214	2017-08-11	see CVE
`CVE-2020-6789`	5.8	7.8	0.0036	2021-03-25	see CVE

T1014 Rootkit ↗
T1057 Process Discovery ↗
T1083 File and Directory Discovery ↗
T1105 Ingress Tool Transfer ↗
T1553 Subvert Trust Controls ↗
T1553.002 Code Signing ↗
T1583 Acquire Infrastructure ↗
T1583.001 Domains ↗

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`CM-2`	2 / 8	25%
`CM-6`	2 / 8	25%
`CM-7`	2 / 8	25%
`SI-4`	2 / 8	25%
`AC-2`	1 / 8	12%
`AC-3`	1 / 8	12%
`AC-4`	1 / 8	12%
`AC-6`	1 / 8	12%
`CA-7`	1 / 8	12%
`CM-10`	1 / 8	12%
`CM-3`	1 / 8	12%
`CM-5`	1 / 8	12%
`CM-8`	1 / 8	12%
`IA-7`	1 / 8	12%
`IA-9`	1 / 8	12%

Co-occurring actors

menuPass 32 shared CVEs
Deep Panda 32 shared CVEs
AnonOps 32 shared CVEs
APT3 32 shared CVEs
Leviathan 32 shared CVEs
COMP-MICROSOFT-SALESFORCE 32 shared CVEs
APT19 32 shared CVEs
APT41 32 shared CVEs
APT1 32 shared CVEs
l group 10 shared CVEs

Similar actors

Similar TTPs

Overlapping CVEs

APT1 1.00
APT3 1.00
APT19 0.97
Deep Panda 0.91
Leviathan 0.84