Lead
Lead is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Technology and Healthcare, in the United States and Japan.
- TG-3279
- Casper
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2016
- Record updated
Who They Target.
About Lead.
In the past few years, Lead’s victims have included: • Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics • Pharmaceutical companies • A company in the chemical industry • University faculty specializing in aeronautical engineering and research • A company involved in the design and manufacture of motor vehicles • A cybersecurity company focusing on protecting industrial control systems During these intrusions, Lead’s objective was to steal sensitive data, including research materials, process documents, and project plans. Lead also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, Lead’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.