| SYMBOL | COMMON_NAME | aka. SYNONYMS |
This threat actor targets software companies and political organizations in the United States, China, Japan, and South Korea. It primarily acts to support cyber operations conducted by other threat actors affiliated with Chinese intelligence services. Believed to be associated with the Axiom, APT 17, and Mirage threat actors. Believed to share the same tools and infrastructure as the threat actors that carried out Operation Aurora, the 2015 targeting of video game companies, the 2015 targeting of the Thai government, and the 2017 targeting of Chinese-language news websites
| 2021-01-14 ⋅ PTSecurity ⋅ Higaisa or Winnti? APT41 backdoors, old and new FunnySwitch |
| 2021-01-14 ⋅ PTSecurity ⋅ Higaisa or Winnti? APT41 backdoors, old and new Cobalt Strike CROSSWALK FunnySwitch PlugX ShadowPad |
| 2020-06-16 ⋅ Intezer ⋅ ELF Malware Analysis 101: Linux Threats No Longer an Afterthought Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti |
| 2020 ⋅ Secureworks ⋅ BRONZE ATLAS Speculoos Winnti ACEHASH CCleaner Backdoor CHINACHOPPER Empire Downloader HTran MimiKatz PlugX Winnti Axiom |
| 2019-05-15 ⋅ Chronicle ⋅ Winnti: More than just Windows and Gates Winnti Axiom |
| 2019 ⋅ Council on Foreign Relations ⋅ Winnti Umbrella Winnti Umbrella |