AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT41
Aliases: APT41, BARIUM, Brass Typhoon, Wicked Panda
[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
Open interactive actor investigation
ATT&CK techniques
T1003.001T1003.002T1003.003T1005T1008T1012T1014T1016T1018T1021.001T1021.002T1027T1027.002T1030T1033T1036.004T1036.005T1037T1046T1047T1049T1053.005T1055T1056.001T1059.001T1059.003T1059.004T1069T1070.003T1070.004T1071.001T1071.002T1071.004T1078T1082T1083T1087.001T1087.002T1090T1098.007T1102.001T1104T1105T1110T1112T1133T1135T1136.001T1190T1195.002T1197T1203T1213.003T1218.001T1218.011T1480.001T1484.001T1486T1496.001T1542.003T1543.003T1546.008T1547.001T1550.002T1553.002T1555T1555.003T1560.001T1566.001T1568.002T1569.002T1570T1574.001T1574.006T1588.002T1595.002T1595.003T1596.005T1599T1684.001T1685T1685.005
Correlated CTI and IR reports
APT41 / Operation DragonRx
CTI Analyst Field Manual · explicit report mentionAPT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise
1200km CTI repository · explicit report mentionAttack Playbook — Operation DragonRx
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionDFIR Playbook — Operation DragonRx
1200km CTI repository · explicit report mentionDetection Guide — Operation DragonRx
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionLab Architecture — Operation DragonRx
1200km CTI repository · explicit report mentionMalicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based Detection
1200km CTI repository · explicit report mentionOperation DragonRx — APT41 Full Attack Simulation
1200km CTI repository · explicit report mentionOperation DragonRx — APT41 Full Attack Simulation
1200km CTI repository · explicit report mentionOperation DragonRx: Simulating an APT41 Attack End-to-End — From Log4Shell to DFIR and Malware Analysis
1200km CTI repository · explicit report mentionRxPhage — Custom PlugX-lite Implant
1200km CTI repository · explicit report mentionAPT41 Targeting Pharmaceutical Sector Log4Shell to Domain Compromise
1200km Medium · authored report mentionAttack Playbook Operation DragonRx
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionOperation DragonRx Simulating an APT41 Attack End to End From Log4Shell to DFIR and Malware
1200km Medium · authored report mention
CTI Analyst Field Manual · explicit report mentionAPT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise
1200km CTI repository · explicit report mentionAttack Playbook — Operation DragonRx
1200km CTI repository · explicit report mentionAttribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionDFIR Playbook — Operation DragonRx
1200km CTI repository · explicit report mentionDetection Guide — Operation DragonRx
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionLab Architecture — Operation DragonRx
1200km CTI repository · explicit report mentionMalicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based Detection
1200km CTI repository · explicit report mentionOperation DragonRx — APT41 Full Attack Simulation
1200km CTI repository · explicit report mentionOperation DragonRx — APT41 Full Attack Simulation
1200km CTI repository · explicit report mentionOperation DragonRx: Simulating an APT41 Attack End-to-End — From Log4Shell to DFIR and Malware Analysis
1200km CTI repository · explicit report mentionRxPhage — Custom PlugX-lite Implant
1200km CTI repository · explicit report mentionAPT41 Targeting Pharmaceutical Sector Log4Shell to Domain Compromise
1200km Medium · authored report mentionAttack Playbook Operation DragonRx
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionOperation DragonRx Simulating an APT41 Attack End to End From Log4Shell to DFIR and Malware
1200km Medium · authored report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- pwdump tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ftp tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ping tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ipconfig tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- dsquery tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- certutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- BITSAdmin tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PowerSploit tool reference — Explicit actor uses software relationship in pinned ATT&CK
- sqlmap tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.002 Security Account Manager simulation — Exact active technique ID
- T1003.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1008 Fallback Channels simulation — Exact active technique ID
- T1008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1014 Rootkit simulation — Exact active technique ID
- T1014 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1030 Data Transfer Size Limits simulation — Exact active technique ID
- T1030 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037 Boot or Logon Initialization Scripts simulation — Exact active technique ID
- T1037 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069 Permission Groups Discovery simulation — Exact active technique ID
- T1069 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.003 Clear Command History simulation — Exact active technique ID
- T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.002 File Transfer Protocols simulation — Exact active technique ID
- T1071.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.004 DNS simulation — Exact active technique ID
- T1071.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.001 Local Account simulation — Exact active technique ID
- T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.007 Additional Local or Domain Groups simulation — Exact active technique ID
- T1098.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.001 Dead Drop Resolver simulation — Exact active technique ID
- T1102.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1104 Multi-Stage Channels simulation — Exact active technique ID
- T1104 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1112 Modify Registry simulation — Exact active technique ID
- T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1135 Network Share Discovery simulation — Exact active technique ID
- T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.001 Local Account simulation — Exact active technique ID
- T1136.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1195.002 Compromise Software Supply Chain simulation — Exact active technique ID
- T1195.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1197 BITS Jobs simulation — Exact active technique ID
- T1197 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.003 Code Repositories simulation — Exact active technique ID
- T1213.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.001 Compiled HTML File simulation — Exact active technique ID
- T1218.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1480.001 Environmental Keying simulation — Exact active technique ID
- T1480.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1484.001 Group Policy Modification simulation — Exact active technique ID
- T1484.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1496.001 Compute Hijacking simulation — Exact active technique ID
- T1496.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1542.003 Bootkit simulation — Exact active technique ID
- T1542.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.008 Accessibility Features simulation — Exact active technique ID
- T1546.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1550.002 Pass the Hash simulation — Exact active technique ID
- T1550.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555 Credentials from Password Stores simulation — Exact active technique ID
- T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1568.002 Domain Generation Algorithms simulation — Exact active technique ID
- T1568.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1569.002 Service Execution simulation — Exact active technique ID
- T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.006 Dynamic Linker Hijacking simulation — Exact active technique ID
- T1574.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.003 Wordlist Scanning simulation — Exact active technique ID
- T1595.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1596.005 Scan Databases simulation — Exact active technique ID
- T1596.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1599 Network Boundary Bridging simulation — Exact active technique ID
- T1599 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
- T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Comparison of distinct actor records only; not attribution of a pharmaceutical incident to APT41. Evidence cutoff: 2026-09-25.