APT41

{
  "id": "ATTACK:mobile:G0096",
  "title": "APT41",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0096",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7",
  "external_id": "G0096",
  "domain": "mobile",
  "created": "2019-09-23T13:43:36.945Z",
  "modified": "2026-07-31T20:48:26.542Z",
  "version": "4.2",
  "aliases": [
    "APT41",
    "Wicked Panda",
    "Brass Typhoon",
    "BARIUM"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Wicked Panda"
    },
    {
      "source_name": "APT41"
    },
    {
      "source_name": "Brass Typhoon"
    },
    {
      "source_name": "BARIUM"
    },
    {
      "source_name": "Crowdstrike GTR2020 Mar 2020",
      "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
    },
    {
      "source_name": "FireEye APT41 2019",
      "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
    },
    {
      "source_name": "FireEye APT41 Aug 2019",
      "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
    },
    {
      "source_name": "apt41_mandiant",
      "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Group IB APT 41 June 2021",
      "url": "https://www.group-ib.com/blog/colunmtk-apt41/"
    }
  ]
}