MITRE ATT&CK G0096
APT41
View MITRE Group Page ↗
Aliases: Barium, Winnti, Wicked Panda, Brass Typhoon
Official Attribution Source: U.S. Department of Justice Indictments (D.D.C., August 2019 & August 2020)
Key Facts
Jurisdiction
People's Republic of China
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
- Attributed Country: People's Republic of China.
- ATT&CK Group Reference: G0096 (APT41).
- Linked to 1 primary court prosecution record(s) with $250.0 million documented loss.
- Identified 0 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1078 Valid Accounts | 1 incidents |
| T1003 OS Credential Dumping | 1 incidents |
| T1560 Archive Collected Data | 1 incidents |
Prosecution Cases Attributed to APT41
Marriott Starwood 383 Million Guest Reservation Breach
settled 2018-11-30
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.
Primary Attack Mechanism: Undetected legacy compromise of the Starwood Hotels & Resorts guest reservation database network dating back to 2014, inherited by Marriott International during its 2016 corporate acquisition.
3 techniques mapped · Loss: $250.0 million
View full case dossier →
Documented TTP Signature for APT41
Test Controls in Stack Audit →T1078: Valid Accounts
Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1003: OS Credential Dumping
Adversaries dump plaintext passwords and hashes from operating system memory structures such as LSASS.
T1560: Archive Collected Data
Adversaries compress and encrypt staged collections of stolen corporate files using utilities such as 7-Zip, RAR, or tar prior to exfiltration.