APT41

ACTIVE CAMPAIGN TRACKED ▲ High Threat China

Primary Aliases: Brass Typhoon Leopard Typhoon WICKED PANDA WICKED SPIDER

Sponsor / State Affiliation People's Republic of China

Primary Motivation State‑sponsored espionage combined with financially motivated cybercrime to support intelligence collection and generate revenue

Confidence Rating 88% (Grounded)

APT41 Semiconductor Supply Chain Intrusion, APT41 Gaming Industry Campaign, APT41 Telecommunications Espionage Wave

⚔️ Weaponized CVE Matrix (3)

Citrix ADC Path Traversal

CVSS 9.8 KEV EPSS 96.4%

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

CVSS 10.0 KEV EPSS 97.5%

🎯 Target Sectors & Focus

Technology Telecommunications Semiconductor Healthcare Gaming Government Defense Finance

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 3

T1566 Spearphishing with malicious attachments

T1566 Supply chain compromise of software updates and gaming platforms

T1566 Exploitation of zero-day vulnerabilities in VPN and firewall products

Execution 1

T1059 Living-off-the-land binaries (LOLBAS) for credential dumping and lateral movement

Persistence & Privilege Escalation 1

T1547 Web shell deployment on exposed web servers

Command & Control 2

T1071 Use of custom malware families (Winnti, PJApps, Spyder)

T1071 C2 via legitimate services (GitHub, Discord, cloud storage)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Systematic A/S CPR Access Application IDOR Vulnerability Leads to Danish CPR Register Breach

Attacks and Vulnerabilities 2026-10-06

[DEEP DIVE] NSFOCUS: China-Based Cybersecurity Firm Enabling Threat Actor Intrusions

Attacks and Vulnerabilities 2026-10-14

Copied to clipboard

LINK COPIED TO CLIPBOARD