apt41-double-dragon

name	apt41-double-dragon
description	Adversary-emulation profile for APT41 (Double Dragon / Wicked Panda / BARIUM / Brass Typhoon, ATT&CK G0096), a Chinese dual-mandate espionage-and-cybercrime actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"APT41, Double Dragon, Wicked Panda, BARIUM, Brass Typhoon, Winnti, G0096, Chinese state-sponsored, dual espionage and cybercrime, supply chain compromise, ShadowPad, PlugX, KEYPLUG, DUSTTRAP, Cobalt Strike, web shell, code-signing certificate theft, video game industry, emulate this actor","tags":"adversary-emulation, apt41, double-dragon, china, mss, espionage, cybercrime, supply-chain, web-shell, cobalt-strike, mitre-attack, g0096","mitre_attack":"T1595.002, T1595.003, T1596.005, T1593.002, T1594, T1583.001, T1583.003, T1583.006, T1583.007, T1588.002, T1588.003, T1195.002, T1190, T1203, T1133, T1566.001, T1684.001, T1059.001, T1059.003, T1059.004, T1059.007, T1218.001, T1218.007, T1218.011, T1047, T1569.002, T1197, T1547.001, T1037, T1136.001, T1543.003, T1546.008, T1542.003, T1053.005, T1505.003, T1134, T1548.002, T1548.003, T1070.003, T1070.004, T1070.005, T1562.006, T1574.001, T1574.006, T1036.004, T1036.005, T1027, T1027.002, T1027.013, T1553.002, T1480.001, T1110, T1555, T1555.003, T1556.001, T1056.001, T1003.001, T1003.002, T1003.003, T1550.002, T1087.001, T1087.002, T1046, T1135, T1057, T1012, T1018, T1518, T1082, T1016, T1049, T1033, T1613, T1083, T1210, T1570, T1021.001, T1021.002, T1071.001, T1071.002, T1071.004, T1001.003, T1008, T1573.002, T1568.002, T1105, T1104, T1571, T1090, T1090.004, T1572, T1102.001, T1102, T1030, T1048.003, T1041, T1567.002, T1119, T1213.003, T1213.006, T1005, T1074.001, T1486"}