APT41 (Winnti)
Prolific China-linked cyber espionage actor (APT41 / Winnti / Double Dragon) active since 2007, blending espionage with financially motivated activity across gaming, tech and telecom.
APT41 (Winnti) is a China-linked group active since at least 2007 that operates a technical-intelligence theft business model while conducting espionage and supply-chain attacks in the gaming, telecom and technology sectors.
Definition
Multi-motive advanced threat group; noted for the 2020 CNVD zero-day disclosure expeditions and supply-chain intrusions; accused of selling stolen technical data derived from espionage access.
Why It Matters / Profile
- Sponsorship: People's Republic of China (assessed)
- Active since: 2007
- Aliases: Winnti, Double Dragon, Barium
Current Status
- Review status: published
- Last updated: 2026-08-26
- Evidence: 2 source(s) · 4 technique(s)
- Confidence: 84%
ATT&CK Techniques
Targets
- Gaming
- Telecom
- Technology
- Software supply chain
Timeline
- 2007-01-01 — Winnti tooling first documented
- 2020-03-01 — CNVD zero-day operation publicly described
- 2024-01-01 — Continued supply-chain intrusions
Sources
Start Investigation
Move from reading to investigating APT41 (Winnti). The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about APT41 (Winnti)?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- IOC LookupSearch OpenTrojan intelligence for indicators attributed to this actor.Look up IOC
Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →