APT41
APT41 is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 45 countries, including the United States and the United Kingdom. It uses 172 MITRE ATT&CK techniques and exploits 29 known CVEs.
- Wicked Panda
- Brass Typhoon
- BARIUM
- Pigfish
- Starchy Taurus
- Origin
- China
- Techniques
- 172
- Exploited CVEs
- 29
- First seen
- Nov 12, 2019
- Last seen
- Dec 18, 2025
- Record updated
Who They Target.
About APT41.
Barium begins its attacks by cultivating relationships with potential victims, particularly those working in Business Development or Human Resources, on various social media platforms. Once Barium has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant, notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred. Also see {{APT 41}} and {{RedGolf}}, which overlap with Barium.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.