# Apt41 Double Dragon

Adversary-emulation profile for APT41 (Double Dragon / Wicked Panda / BARIUM / Brass...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt41-double-dragon -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt41-double-dragon -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt41-double-dragon -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt41-double-dragon -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT41 (Double Dragon / Wicked Panda / BARIUM / Brass Typhoon, ATT&CK G0096), a Chinese dual-mandate espionage-and-cybercrime actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT41 (Double Dragon, Wicked Panda, BARIUM), Adversary Emulation Profile

APT41 (MITRE ATT&CK **G0096**; also tracked as Double Dragon, Wicked Panda, Winnti, BARIUM, and Microsoft's **Brass Typhoon**) is a prolific Chinese threat actor unique for running **state-sponsored cyber-espionage in parallel with financially motivated cybercrime**, often reusing the same non-public malware for both missions. First publicly profiled by FireEye/Mandiant in August 2019, the group has been active since at least 2012, beginning in the video-game economy (virtual-currency theft, ransomware, code-signing certificate theft) and expanding into wide-ranging espionage. APT41 is best known for **software supply-chain compromises** (poisoning legitimately signed installers), rapid weaponization of newly disclosed vulnerabilities, abuse of **stolen code-signing certificates**, and a deep, modular toolset spanning Windows and Linux. This profile maps APT41's documented TTPs to ATT&CK so Decepticon can emulate them under authorized scope and the blue cell can anticipate detection.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt41-double-dragon/SKILL.md