APT41 (Double Dragon, Wicked Panda, BARIUM), Adversary Emulation Profile

APT41 (MITRE ATT&CK G0096; also tracked as Double Dragon, Wicked Panda, Winnti, BARIUM, and Microsoft's Brass Typhoon) is a prolific Chinese threat actor unique for running state-sponsored cyber-espionage in parallel with financially motivated cybercrime, often reusing the same non-public malware for both missions. First publicly profiled by FireEye/Mandiant in August 2019, the group has been active since at least 2012, beginning in the video-game economy (virtual-currency theft, ransomware, code-signing certificate theft) and expanding into wide-ranging espionage. APT41 is best known for software supply-chain compromises (poisoning legitimately signed installers), rapid weaponization of newly disclosed vulnerabilities, abuse of stolen code-signing certificates, and a deep, modular toolset spanning Windows and Linux. This profile maps APT41's documented TTPs to ATT&CK so Decepticon can emulate them under authorized scope and the blue cell can anticipate detection.

Attribution & motivation