not MITRE’s ATT&CK Group
APT41
How MITRE ATT&CK characterizes this group1: APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission…
Attributed to China — state-linked, dual espionage/criminal by government advisory.119
Read as a state-directed operator, not a smash-and-grab.
A nation-state classification means patience, tradecraft, and an intelligence objective. When this name attaches to a vulnerability, the question shifts from “will someone exploit it” to “has a well-resourced service already built it into an operation.” All tradecraft below is sourced to MITRE ATT&CK.
Known for
— signature moves, each sourced to ATT&CKTradecraft heatmap
— ATT&CK techniques mapped onto the five attacker-outcome narrativesEach row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.
Reach: this actor’s cited techniques light columns 1·2·3·4·5 — furthest is 5 · Lights out. (furthest-position idiom, reused from the landing map).
Arsenal
— named tools & malware ATT&CK attributes to this groupATT&CK attributes 32 tools/malware to G0096 in total; the full list is on the group page.
Campaign highlights
— attributed operations in the ATT&CK recordC0017 — ATT&CK Campaign C0017
APT41 DUST — ATT&CK Campaign C0040
Latest activity
— with explicit confidence, and what we cannot yet claimsnapshot
The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.
These are not confirmed attribution. An inferred link is a structural ATT&CK chain (this group uses a tool whose reference cites the CVE); it is back-cited to the original report and never claims the source names the group.
ATT&CK attributes gh0st RAT (S0032) to this group, and that software’s ATT&CK reference cites CVE-2015-5119. Structural chain — not a statement that the report names the group.
original report (cited on the ATT&CK software page) ↗