apt41-double-dragon

name	apt41-double-dragon
description	Adversary-emulation profile for APT41 (Double Dragon / Wicked Panda / BARIUM / Brass Typhoon, ATT&CK G0096), a Chinese dual-mandate espionage-and-cybercrime actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"APT41, Double Dragon, Wicked Panda, BARIUM, Brass Typhoon, Winnti, G0096, Chinese state-sponsored, dual espionage and cybercrime, supply chain compromise, ShadowPad, PlugX, KEYPLUG, DUSTTRAP, Cobalt Strike, web shell, code-signing certificate theft, video game industry, emulate this actor","tags":"adversary-emulation, apt41, double-dragon, china, mss, espionage, cybercrime, supply-chain, web-shell, cobalt-strike, mitre-attack, g0096","mitre_attack":"T1595.002, T1595.003, T1596.005, T1593.002, T1594, T1583.001, T1583.003, T1583.006, T1583.007, T1588.002, T1588.003, T1195.002, T1190, T1203, T1133, T1566.001, T1684.001, T1059.001, T1059.003, T1059.004, T1059.007, T1218.001, T1218.007, T1218.011, T1047, T1569.002, T1197, T1547.001, T1037, T1136.001, T1543.003, T1546.008, T1542.003, T1053.005, T1505.003, T1134, T1548.002, T1548.003, T1070.003, T1070.004, T1070.005, T1562.006, T1574.001, T1574.006, T1036.004, T1036.005, T1027, T1027.002, T1027.013, T1553.002, T1480.001, T1110, T1555, T1555.003, T1556.001, T1056.001, T1003.001, T1003.002, T1003.003, T1550.002, T1087.001, T1087.002, T1046, T1135, T1057, T1012, T1018, T1518, T1082, T1016, T1049, T1033, T1613, T1083, T1210, T1570, T1021.001, T1021.002, T1071.001, T1071.002, T1071.004, T1001.003, T1008, T1573.002, T1568.002, T1105, T1104, T1571, T1090, T1090.004, T1572, T1102.001, T1102, T1030, T1048.003, T1041, T1567.002, T1119, T1213.003, T1213.006, T1005, T1074.001, T1486"}

APT41 (Double Dragon, Wicked Panda, BARIUM) — Adversary Emulation Profile

APT41 (MITRE ATT&CK G0096; also tracked as Double Dragon, Wicked Panda, Winnti, BARIUM, and Microsoft's Brass Typhoon) is a prolific Chinese threat actor unique for running state-sponsored cyber-espionage in parallel with financially motivated cybercrime — often reusing the same non-public malware for both missions. First publicly profiled by FireEye/Mandiant in August 2019, the group has been active since at least 2012, beginning in the video-game economy (virtual-currency theft, ransomware, code-signing certificate theft) and expanding into wide-ranging espionage. APT41 is best known for software supply-chain compromises (poisoning legitimately signed installers), rapid weaponization of newly disclosed vulnerabilities, abuse of stolen code-signing certificates, and a deep, modular toolset spanning Windows and Linux. This profile maps APT41's documented TTPs to ATT&CK so Decepticon can emulate them under authorized scope and the blue cell can anticipate detection.

Attribution & motivation

• Suspected sponsor / nation: People's Republic of China. Mandiant assesses APT41 operates under the MSS (Ministry of State Security) contractor model — nominally private companies executing intelligence taskings for provincial MSS bureaus — rather than the PLA model. The group is operationally linked to the Chengdu-based front company Chengdu 404 Network Technology Co., Ltd.
• Motivation: Dual-mandate. Espionage (intellectual property, strategic intelligence, surveillance of dissidents/pro-democracy figures) interleaved with financial gain (game virtual-currency manipulation, ransomware, cryptomining). Mandiant observed espionage during Beijing business hours and financially motivated activity during off-hours, suggesting moonlighting on shared infrastructure.
• Confidence: High for China nexus and dual motivation. The U.S. DOJ on September 16, 2020 indicted five Chinese nationals (Zhang Haoran, Tan Dailin, Jiang Lizhi, Qian Chuan, Fu Qiang) and two Malaysian accomplices (Wong Ong Hua, Ling Yang Ching) in connection with attacks on 100+ victims globally, lending strong public attribution. Specific operation-to-operator mapping within individual intrusions carries lower confidence.

Targeting

• Sectors: Video games & game publishers, software/IT and computer hardware, telecommunications (incl. call-record interception), healthcare & pharmaceuticals, high-tech/semiconductors, media & entertainment, shipping & logistics, automotive, financial services, education, think tanks, and government.