Security Resilience

Threat actor · all actors

APT41G0096 state-contractor

🇨🇳 CN · MSS

aka APT41, Wicked Panda, Brass Typhoon, BARIUM

Last updated: 2026-10-16

52attributed CVEs
115ATT&CK techniques
123.5IDF score (tooling uniqueness)
0exclusive CVEs
2012–2024years active

About this actor

[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0096

Microsoftweather-system names

Brass Typhoon

CrowdStrikenation-animal names

Wicked Panda

Mandiant / genericAPT numbering

APT41

Unclassifiedno scheme matched

BARIUM

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 115 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2012: 1 CVE published120122015: 1 CVE published120152017: 3 CVE published320172018: 3 CVE published320182019: 13 CVE published1320192020: 17 CVE published1720202021: 14 CVE published2021: 46 KEV added6020212022: 3 KEV added320222024: 1 KEV added12024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2020-1350 KEV10.010.00.96722020-07-14see CVE
CVE-2021-22893 KEV10.010.00.97002021-04-23see CVE
CVE-2015-4852 KEV9.99.80.96882015-11-18see CVE
CVE-2018-4939 KEV9.99.80.97322018-05-19see CVE
CVE-2018-6789 KEV9.99.80.97482018-02-08see CVE
CVE-2018-7600 KEV9.99.81.00002018-03-29see CVE
CVE-2019-0604 KEV9.99.80.99912019-03-05see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2019-11580 KEV9.99.80.97502019-06-03see CVE
CVE-2019-16278 KEV9.99.80.99062019-10-14see CVE
CVE-2019-16920 KEV9.99.81.00002019-09-27see CVE
CVE-2019-18935 KEV9.99.80.99742019-12-11see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-3396 KEV9.99.80.99912019-03-25see CVE
CVE-2020-10189 KEV9.99.80.99942020-03-06see CVE
CVE-2020-12812 KEV9.99.80.49342020-07-24see CVE
CVE-2020-15505 KEV9.99.80.99742020-07-07see CVE
CVE-2020-2555 KEV9.99.80.97122020-01-15see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2020-8515 KEV9.99.80.99992020-02-01see CVE
CVE-2021-21985 KEV9.99.81.00002021-05-26see CVE
CVE-2021-27101 KEV9.99.80.06002021-02-16see CVE
CVE-2021-27103 KEV9.99.80.11412021-02-16see CVE
CVE-2021-27104 KEV9.99.80.56692021-02-16see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2012-0158 KEV9.28.80.99992012-04-10see CVE
CVE-2017-6327 KEV9.28.80.78182017-08-11see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2020-3118 KEV9.28.80.11812020-02-05see CVE
CVE-2021-22894 KEV9.28.80.50622021-05-27see CVE
CVE-2021-22899 KEV9.28.80.38002021-05-27see CVE
CVE-2020-1040 KEV9.09.00.07392020-07-14see CVE
CVE-2020-0601 KEV8.78.10.97332020-01-14see CVE
CVE-2017-11882 KEV8.57.80.99942017-11-15see CVE
CVE-2019-0803 KEV8.57.80.90362019-04-09see CVE
CVE-2019-1653 KEV8.57.50.99882019-01-24see CVE
CVE-2020-0787 KEV8.57.80.91412020-03-12see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2021-27102 KEV8.57.80.03652021-02-16see CVE
CVE-2019-1652 KEV8.17.20.97472019-01-24see CVE
CVE-2021-22900 KEV8.17.20.14152021-05-27see CVE
CVE-2020-8193 KEV7.86.50.97462020-07-10see CVE
CVE-2019-5591 KEV7.76.50.56822020-08-14see CVE
CVE-2020-8195 KEV7.76.50.95852020-07-10see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2020-8196 KEV7.54.30.70662020-07-10see CVE
CVE-2017-6328 6.98.80.02142017-08-11see CVE
CVE-2020-6789 5.87.80.00362021-03-25see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-474 / 11564%
CM-670 / 11561%
CM-258 / 11550%
AC-355 / 11548%
CM-754 / 11547%
AC-652 / 11545%
SI-350 / 11543%
AC-248 / 11542%
CA-747 / 11541%
SI-740 / 11535%
AC-539 / 11534%
IA-237 / 11532%
CM-536 / 11531%
AC-433 / 11529%
SC-732 / 11528%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category